From ccec8e7d8711d307d6b62549784faa8ec8287aa4 Mon Sep 17 00:00:00 2001
From: Jake Bailey <5341706+jakebailey@users.noreply.github.com>
Date: Mon, 23 Feb 2026 07:22:29 -0800
Subject: [PATCH] fix(config): respect lockfile: false setting from
 pnpm-workspace.yaml (#10672)

* fix(config): respect lockfile: false setting from pnpm-workspace.yaml

* fix(config): derive lockfile settings after all config sources are applied

* fix(config): use lockfile instead of useLockfile in integration tests
---
 .changeset/large-flowers-roll.md |  5 +++
 config/config/src/index.ts       | 43 +++++++++++-----------
 config/config/test/index.ts      | 63 ++++++++++++++++++++++++++++++++
 pnpm/test/config.ts              |  2 +-
 pnpm/test/install/misc.ts        |  4 +-
 5 files changed, 93 insertions(+), 24 deletions(-)
 create mode 100644 .changeset/large-flowers-roll.md

diff --git a/.changeset/large-flowers-roll.md b/.changeset/large-flowers-roll.md
new file mode 100644
index 0000000000..abd9d68a3a
--- /dev/null
+++ b/.changeset/large-flowers-roll.md
@@ -0,0 +1,5 @@
+---
+"@pnpm/config": patch
+---
+
+Fixed `lockfile: false` in `pnpm-workspace.yaml` being ignored, causing `pnpm-lock.yaml` to be created despite the setting.
diff --git a/config/config/src/index.ts b/config/config/src/index.ts
index 9f0722cfc3..af501915ee 100644
--- a/config/config/src/index.ts
+++ b/config/config/src/index.ts
@@ -326,11 +326,6 @@ export async function getConfig (opts: {
   pnpmConfig.authInfos = networkConfigs.authInfos ?? {} // TODO: remove `?? {}` (when possible)
   pnpmConfig.sslConfigs = networkConfigs.sslConfigs
   Object.assign(pnpmConfig, getDefaultAuthInfo(pnpmConfig.rawConfig))
-  pnpmConfig.useLockfile = (() => {
-    if (typeof pnpmConfig.lockfile === 'boolean') return pnpmConfig.lockfile
-    if (typeof pnpmConfig.packageLock === 'boolean') return pnpmConfig.packageLock
-    return false
-  })()
   pnpmConfig.pnpmHomeDir = getDataDir(process)
   let globalDirRoot
   if (pnpmConfig.globalDir) {
@@ -434,22 +429,6 @@ export async function getConfig (opts: {
     }
   }
 
-  pnpmConfig.useGitBranchLockfile = (() => {
-    if (typeof pnpmConfig.gitBranchLockfile === 'boolean') return pnpmConfig.gitBranchLockfile
-    return false
-  })()
-  pnpmConfig.mergeGitBranchLockfiles = await (async () => {
-    if (typeof pnpmConfig.mergeGitBranchLockfiles === 'boolean') return pnpmConfig.mergeGitBranchLockfiles
-    if (pnpmConfig.mergeGitBranchLockfilesBranchPattern != null && pnpmConfig.mergeGitBranchLockfilesBranchPattern.length > 0) {
-      const branch = await getCurrentBranch()
-      if (branch) {
-        const branchMatcher = createMatcher(pnpmConfig.mergeGitBranchLockfilesBranchPattern)
-        return branchMatcher(branch)
-      }
-    }
-    return undefined
-  })()
-
   // omit some schema that the custom parser can't yet handle
   const envPnpmTypes = omit([
     'init-version', // the type is a private function named 'semver'
@@ -478,6 +457,28 @@ export async function getConfig (opts: {
 
   overrideSupportedArchitecturesWithCLI(pnpmConfig, cliOptions)
 
+  pnpmConfig.useLockfile = (() => {
+    if (typeof pnpmConfig.lockfile === 'boolean') return pnpmConfig.lockfile
+    if (typeof pnpmConfig.packageLock === 'boolean') return pnpmConfig.packageLock
+    return false
+  })()
+
+  pnpmConfig.useGitBranchLockfile = (() => {
+    if (typeof pnpmConfig.gitBranchLockfile === 'boolean') return pnpmConfig.gitBranchLockfile
+    return false
+  })()
+  pnpmConfig.mergeGitBranchLockfiles = await (async () => {
+    if (typeof pnpmConfig.mergeGitBranchLockfiles === 'boolean') return pnpmConfig.mergeGitBranchLockfiles
+    if (pnpmConfig.mergeGitBranchLockfilesBranchPattern != null && pnpmConfig.mergeGitBranchLockfilesBranchPattern.length > 0) {
+      const branch = await getCurrentBranch()
+      if (branch) {
+        const branchMatcher = createMatcher(pnpmConfig.mergeGitBranchLockfilesBranchPattern)
+        return branchMatcher(branch)
+      }
+    }
+    return undefined
+  })()
+
   if (!hasDependencyBuildOptions(pnpmConfig)) {
     Object.assign(pnpmConfig, globalDepsBuildConfig)
   }
diff --git a/config/config/test/index.ts b/config/config/test/index.ts
index 01aef24e25..b7aff4da4f 100644
--- a/config/config/test/index.ts
+++ b/config/config/test/index.ts
@@ -1462,3 +1462,66 @@ describe('global config.yaml', () => {
     expect(config.rawConfig).toHaveProperty(['dangerously-allow-all-builds'])
   })
 })
+
+test('lockfile: false in pnpm-workspace.yaml sets useLockfile to false', async () => {
+  prepareEmpty()
+
+  writeYamlFile('pnpm-workspace.yaml', {
+    lockfile: false,
+  })
+
+  const { config } = await getConfig({
+    cliOptions: {},
+    packageManager: {
+      name: 'pnpm',
+      version: '1.0.0',
+    },
+    workspaceDir: process.cwd(),
+  })
+
+  expect(config.useLockfile).toBe(false)
+})
+
+test('pnpm_config_lockfile env var overrides lockfile from pnpm-workspace.yaml in useLockfile', async () => {
+  prepareEmpty()
+
+  writeYamlFile('pnpm-workspace.yaml', {
+    lockfile: true,
+  })
+
+  const { config } = await getConfig({
+    cliOptions: {},
+    env: {
+      pnpm_config_lockfile: 'false',
+    },
+    packageManager: {
+      name: 'pnpm',
+      version: '1.0.0',
+    },
+    workspaceDir: process.cwd(),
+  })
+
+  expect(config.useLockfile).toBe(false)
+})
+
+test('pnpm_config_git_branch_lockfile env var overrides git-branch-lockfile from pnpm-workspace.yaml in useGitBranchLockfile', async () => {
+  prepareEmpty()
+
+  writeYamlFile('pnpm-workspace.yaml', {
+    gitBranchLockfile: false,
+  })
+
+  const { config } = await getConfig({
+    cliOptions: {},
+    env: {
+      pnpm_config_git_branch_lockfile: 'true',
+    },
+    packageManager: {
+      name: 'pnpm',
+      version: '1.0.0',
+    },
+    workspaceDir: process.cwd(),
+  })
+
+  expect(config.useGitBranchLockfile).toBe(true)
+})
diff --git a/pnpm/test/config.ts b/pnpm/test/config.ts
index e02bb11ed0..fa456e525f 100644
--- a/pnpm/test/config.ts
+++ b/pnpm/test/config.ts
@@ -5,7 +5,7 @@ import { execPnpmSync } from './utils/index.js'
 
 test('read settings from pnpm-workspace.yaml', async () => {
   prepare()
-  fs.writeFileSync('pnpm-workspace.yaml', 'useLockfile: false', 'utf8')
+  fs.writeFileSync('pnpm-workspace.yaml', 'lockfile: false', 'utf8')
   expect(execPnpmSync(['install']).status).toBe(0)
   expect(fs.existsSync(WANTED_LOCKFILE)).toBeFalsy()
 })
diff --git a/pnpm/test/install/misc.ts b/pnpm/test/install/misc.ts
index 75b3822d75..05fe4b57d0 100644
--- a/pnpm/test/install/misc.ts
+++ b/pnpm/test/install/misc.ts
@@ -72,11 +72,11 @@ test('write to stderr when --use-stderr is used', async () => {
   expect(result.stderr.toString()).not.toBe('')
 })
 
-test('install with useLockfile being false in pnpm-workspace.yaml', async () => {
+test('install with lockfile being false in pnpm-workspace.yaml', async () => {
   const project = prepare()
 
   writeYamlFile('pnpm-workspace.yaml', {
-    useLockfile: false,
+    lockfile: false,
   })
 
   await execPnpm(['add', 'is-positive'])