Hello,
I am using Nexus Repository Community Edition 3.95.0, deployed in Docker, with an npm hosted repository.
Current Behaviour:
When publishing multiple versions of the same npm package in a specific order, the npm metadata served by Nexus appears to be inconsistent with npm SemVer resolution.
In my case, I publish:
-
express@5.2.0 -
express@5.0.0
The metadata correctly contains both versions:
"versions": [
"5.0.0",
"5.2.0"
]
and the dist-tags.latest is correctly set to:
"latest": "5.0.0"
However, when running:
npm install express@^5.0.0
npm installs 5.0.0 instead of 5.2.0.
This appears to indicate that Nexus is not providing npm metadata in a way that allows npm to correctly resolve the highest version satisfying the ^5.0.0 range.
Expected Behaviour:
According to npm SemVer resolution, ^5.0.0 matches both:
-
5.0.0 -
5.2.0
Therefore, when both versions are available, the expected result is:
express@5.2.0
The latest dist-tag should not affect the resolution of an explicit semver range such as:
npm install express@^5.0.0
In particular, having:
"dist-tags": {
"latest": "5.0.0"
}
should not cause npm to select 5.0.0 over the higher matching version 5.2.0.