Nexus Repository does not respect npm semver versionning

Sonatype Nexus Repository
, ,
1

Hello,

I am using Nexus Repository Community Edition 3.95.0, deployed in Docker, with an npm hosted repository.

Current Behaviour:

When publishing multiple versions of the same npm package in a specific order, the npm metadata served by Nexus appears to be inconsistent with npm SemVer resolution.

In my case, I publish:

  1. express@5.2.0

  2. express@5.0.0

The metadata correctly contains both versions:

"versions": [
  "5.0.0",
  "5.2.0"
]

and the dist-tags.latest is correctly set to:

"latest": "5.0.0"

However, when running:

npm install express@^5.0.0

npm installs 5.0.0 instead of 5.2.0.

This appears to indicate that Nexus is not providing npm metadata in a way that allows npm to correctly resolve the highest version satisfying the ^5.0.0 range.

Expected Behaviour:

According to npm SemVer resolution, ^5.0.0 matches both:

  • 5.0.0

  • 5.2.0

Therefore, when both versions are available, the expected result is:

express@5.2.0

The latest dist-tag should not affect the resolution of an explicit semver range such as:

npm install express@^5.0.0

In particular, having:

"dist-tags": {
  "latest": "5.0.0"
}

should not cause npm to select 5.0.0 over the higher matching version 5.2.0.

2

@Dark_Jo how did you publish the 5.2.0 package? Did you use the npm CLI or did you use component upload through the UI or Nexus REST API?

3

Hello,

Thank you for your response,

I used npm cli

4

Thanks, I think 3.96 includes a fix that will maintain that version.

5

Does “maintain that version” mean that Nexus 3.96 fixes the npm metadata/version resolution issue described above, so that publishing 5.2.0 followed by 5.0.0 will still preserve 5.2.0 correctly for SemVer resolution?

Also as the bug is also present in 3.85.0 version is it possible to backport the bugfix to 3.85.X,

Thanks in advance

6

Hello,

Any news,

Thanks

7

Hi! I don’t have a direct update for you yet: I’ll set a personal reminder to check in with you in a few days.

8

We have a bugfix in 3.96 (due to release today) which should address this issue. We do not have plans to backport the bugfix.

9

Hello,

I tried on 3.96 and I have the same bug, seems that has not been resolved

10

@Dark_Jo the fix that went in is about updating the latest when publishing, it wasn’t applied to existing metadata. Are you experiencing an issue where a higher version doesn’t replace latest or an older version does?

When you asked the question, I’d already written a fix in this area for the Pro Import-Export tasks and when I checked the code path it looked as if it should also apply here.

11

Yes, exactly. The issue is that an older version can replace latest.

For example, if I publish 5.2.0 first and then 5.0.0, latest ends up pointing to 5.0.0.

This is especially problematic because it directly impacts npm SemVer resolution: if a consumer has ^5.0.0, npm resolves to 5.0.0 instead of 5.2.0, even though 5.2.0 has already been published.

So the issue isn’t only that the latest metadata is incorrect — it actually causes consumers using ranges such as ^5.0.0 to potentially get an older version.

12

I understand, but have you tried the same process again this change doesn’t alter existing metadata.

13

I tried on a fresh instance and encounter the problem