"npm publish" tags pre-versions as "latest" #13248
|
As a temporary measure, I have created this package: GitHub: https://github.com/scott113341/npm-publish-safe-latest |
|
|
|
One other thing I discovered:
|
I totally agree. Users should not get prereleases by default. The point of prereleases is to be before a release so if the author is publishing a prerelease they usually don't want their community to get it by default until more testing has been done with that prerelease. By allowing prereleases to become the default when the user doesn't specify the version, npm is encouraging huge instability in codebases using npm. |
I'm opening this issue because:
What's going wrong?
Running
npm version premajor && npm publishwill tag the premajor version aslatestby default. I confirmed this happens when running all pre-release options:premajor | preminor | prepatch | prerelease.(I was not able to verify the behavior resulting from the
from-gitoption due to an error:Error: Version not changed, /Users/scott/.nvm/versions/node/v6.2.2/lib/node_modules/npm/lib/version.js:92:47. This happened when my most recent commit's tag was set tovX.0.0-0,vX.0.0,X.0.0-0, andX.0.0, whereXwas a version number that was greater than all other previous versions. This may be a separate issue, or I was doing something wrong.)As @iarna pointed out in #10189, there are valid reasons that authors would want to tag pre-release versions as
latest. However, I think that this is not good default behavior (though it is documented: "Publishing a package sets the latest tag to the published version unless the --tag option is used. For example, npm publish --tag=beta.")Semver documentation states:
Source: http://semver.org/#spec-item-9
I propose that the
latesttag only be set if the version to be published is not a pre-release version. I am happy to do the work on this and submit a PR, but I'd like to first discuss and get approval before putting the time in.Thank you for your hard work on npm!
How can the CLI team reproduce the problem?
From https://www.npmjs.com/package/@scott113341/testo
supporting information:
npm -vprints:3.10.3node -vprints:v6.2.2npm config get registryprints:https://registry.npmjs.org/OS XUSA