# X_LOCKFILE_STALE

## Means

`bun.lock` records an `@ultimat3/*` range that the `package.json` it was generated from no longer declares

## Typical cause

a lockstep bump. `bun install` refreshes a workspace block only when that workspace's own manifest changed, and `--frozen-lockfile` accepts every stale one because a workspace edge resolves by **name** — the range is never read back. 90 entries sat at 1.2.0 and 2.0.0 against manifests that all said 3.0.0

## Fix

`bun run scripts/lockfile-pins.ts --write`, then `bun install --frozen-lockfile` to confirm. Not `rm bun.lock && bun install`, which also drags every external dependency to its newest match — measured once as Biome 2.5.5 → 2.5.9 and `@types/node` 26.1.1 → 26.2.0

[CLI and verify](/error-codes#cli-and-verify)