Pin exact npm (or Yarn/pnpm/Bun) version in Cloudflare Workers Builds

Cloudflare Workers Builds now looks for a packageManager entry in your package.json and installs that exact npm (or Yarn, pnpm, Bun) version before running npm install. The change removes reliance on the default manager version and makes the build environment match the version that generated your lockfile.

Specifying the version

Insert a top‑level key in package.json with the full manager identifier. Use an exact version string; ranges are not supported.

{ "packageManager": "npm@11.19.1" }

Effect on build reproducibility

Because the manager version is fixed, a lockfile created with a newer npm will resolve dependencies the same way in the CI build as it does locally. This eliminates the classic "works locally but fails in CI" scenario caused by subtle differences in version‑specific resolution or peer‑dependency handling.

Operational and security considerations

• Only the packageManager field influences the manager version; the engines.npm field is ignored.
• Exact version pinning prevents accidental upgrades that could introduce breaking changes or unexpected behavior.
• Since the manager is installed as part of the build image, there is no need to manage separate toolchain containers or custom images for version control.
• Using a known manager version reduces the attack surface of supply‑chain tooling, as you can audit the specific binary that runs in the build environment.

Related CloudNinjas coverage: hands-on guides.

What This Means For Practitioners

Update your repository’s package.json with a packageManager entry matching the version you use locally. Verify the change in a test build, and incorporate the check into your CI pipeline to catch missing or mismatched entries early. Treat the field as the single source of truth for the package manager version across all Workers build workflows.