title: How to have yarn fail on yarn install when package.json and yarn.lock are out of sync?
body: <p>On a project I have replaced npm with yarn to get the benefits of it, and also enforce our dependencies are locked in via the <code>yarn.lock</code>.</p>
  <p>Now, a developer added a library with npm@4, which only changed the <code>package.json</code>, and not of course the <code>yarn.lock</code>.</p>
  <p>I would have expected the <code>yarn install</code> command to crash on the build server, yet yarn has the--to me unexpected behavior--of adding those libraries in their most current version and then updating the <code>yarn.lock</code> on the remote:</p>
  <pre><code>$ yarn install
  [1/4] Resolving packages...
  [2/4] Fetching packages...
  warning fsevents@1.1.2: The platform &quot;linux&quot; is incompatible with this module.
  info &quot;fsevents@1.1.2&quot; is an optional dependency and failed compatibility check. Excluding it from installation.
  [3/4] Linking dependencies...
  [4/4] Building fresh packages...
  success Saved lockfile.
  Done in 5.07s.
  </code></pre>
  <p>This contradicts yarn's purpose, as the build job does not push the <code>yarn.lock</code> back to the repository nor should it.</p>
  <p>I want each developer to be responsible of the version they are checking in.</p>
  <p>Hence, is there a way to have <code>yarn install</code> exit with an error code if the <code>package.json</code> and <code>yarn.lock</code> are out of sync?</p>