# Nexus Repository does not respect npm semver versionning

**URL:** <https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545>\
**Category:** Sonatype Nexus Repository\
**Tags:** help, nexus-repository, npm\
**Created:** [August 13, 2026, 2:54pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545 "2026-08-13T14:54:41Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dark\_Jo](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@Dark\_Jo](https://community.sonatype.com/u/Dark_Jo)\
**Post date:** [August 13, 2026, 2:54pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/1 "2026-08-13T14:54:41Z")

</div>

Hello,

I am using **Nexus Repository Community Edition 3.95.0** , deployed in Docker, with an **npm hosted repository**.

**Current Behaviour:**

When publishing multiple versions of the same npm package in a specific order, the npm metadata served by Nexus appears to be inconsistent with npm SemVer resolution.

In my case, I publish:

1. `express@5.2.0`

2. `express@5.0.0`

The metadata correctly contains both versions:

```auto
"versions": [
  "5.0.0",
  "5.2.0"
]

```

and the `dist-tags.latest` is correctly set to:

```auto
"latest": "5.0.0"

```

However, when running:

```auto
npm install express@^5.0.0

```

npm installs **5.0.0** instead of **5.2.0**.

This appears to indicate that Nexus is not providing npm metadata in a way that allows npm to correctly resolve the highest version satisfying the `^5.0.0` range.

* * *

**Expected Behaviour:**

According to npm SemVer resolution, `^5.0.0` matches both:

- `5.0.0`

- `5.2.0`

Therefore, when both versions are available, the expected result is:

```auto
express@5.2.0

```

The `latest` dist-tag should **not** affect the resolution of an explicit semver range such as:

```auto
npm install express@^5.0.0

```

In particular, having:

```auto
"dist-tags": {
  "latest": "5.0.0"
}

```

should not cause npm to select `5.0.0` over the higher matching version `5.2.0`.

---

<div class="post-metadata">

**Author:** ![mpiggott](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mpiggott](https://community.sonatype.com/u/mpiggott)\
**Post date:** [August 13, 2026, 5:59pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/2 "2026-08-13T17:59:27Z")

</div>

@Dark_Jo how did you publish the `5.2.0` package? Did you use the npm CLI or did you use component upload through the UI or Nexus REST API?

---

<div class="post-metadata">

**Author:** ![Dark\_Jo](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@Dark\_Jo](https://community.sonatype.com/u/Dark_Jo)\
**Post date:** [August 13, 2026, 6:47pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/3 "2026-08-13T18:47:29Z")

</div>

Hello,

Thank you for your response,

I used npm cli

---

<div class="post-metadata">

**Author:** ![mpiggott](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mpiggott](https://community.sonatype.com/u/mpiggott)\
**Post date:** [August 13, 2026, 7:00pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/4 "2026-08-13T19:00:17Z")

</div>

Thanks, I think 3.96 includes a fix that will maintain that version.

---

<div class="post-metadata">

**Author:** ![Dark\_Jo](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@Dark\_Jo](https://community.sonatype.com/u/Dark_Jo)\
**Post date:** [August 13, 2026, 7:33pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/5 "2026-08-13T19:33:52Z")

</div>

Does “maintain that version” mean that Nexus 3.96 fixes the npm metadata/version resolution issue described above, so that publishing `5.2.0` followed by `5.0.0` will still preserve `5.2.0` correctly for SemVer resolution?

Also as the bug is also present in 3.85.0 version is it possible to backport the bugfix to 3.85.X,

Thanks in advance

---

<div class="post-metadata">

**Author:** ![Dark\_Jo](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@Dark\_Jo](https://community.sonatype.com/u/Dark_Jo)\
**Post date:** [August 24, 2026, 9:43pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/6 "2026-08-24T21:43:52Z")

</div>

Hello,

Any news,

Thanks

---

<div class="post-metadata">

**Author:** ![jzora](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/jzora/32/4197_2.png) [@jzora](https://community.sonatype.com/u/jzora)\
**Post date:** [August 25, 2026, 2:31pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/7 "2026-08-25T14:31:35Z")

</div>

Hi! I don’t have a direct update for you yet: I’ll set a personal reminder to check in with you in a few days.

---

<div class="post-metadata">

**Author:** ![jzora](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/jzora/32/4197_2.png) [@jzora](https://community.sonatype.com/u/jzora)\
**Post date:** [August 31, 2026, 5:24pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/8 "2026-08-31T17:24:28Z")

</div>

We have a bugfix in 3.96 (due to release today) which _should_ address this issue. We do not have plans to backport the bugfix.

---

<div class="post-metadata">

**Author:** ![Dark\_Jo](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@Dark\_Jo](https://community.sonatype.com/u/Dark_Jo)\
**Post date:** [September 2, 2026, 6:59pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/9 "2026-09-02T18:59:52Z")

</div>

Hello,

I tried on 3.96 and I have the same bug, seems that has not been resolved

---

<div class="post-metadata">

**Author:** ![mpiggott](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mpiggott](https://community.sonatype.com/u/mpiggott)\
**Post date:** [September 3, 2026, 1:29pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/10 "2026-09-03T13:29:03Z")

</div>

@Dark_Jo the fix that went in is about updating the latest when publishing, it wasn’t applied to existing metadata. Are you experiencing an issue where a higher version doesn’t replace `latest` or an older version does?

When you asked the question, I’d already written a fix in this area for the Pro Import-Export tasks and when I checked the code path it looked as if it should also apply here.

---

<div class="post-metadata">

**Author:** ![Dark\_Jo](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@Dark\_Jo](https://community.sonatype.com/u/Dark_Jo)\
**Post date:** [September 3, 2026, 6:46pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/11 "2026-09-03T18:46:11Z")

</div>

Yes, exactly. The issue is that an older version can replace latest.

For example, if I publish 5.2.0 first and then 5.0.0, latest ends up pointing to 5.0.0.

This is especially problematic because it directly impacts npm SemVer resolution: if a consumer has ^5.0.0, npm resolves to 5.0.0 instead of 5.2.0, even though 5.2.0 has already been published.

So the issue isn’t only that the latest metadata is incorrect — it actually causes consumers using ranges such as ^5.0.0 to potentially get an older version.

---

<div class="post-metadata">

**Author:** ![mpiggott](https://avatars.discourse-cdn.com/v4/letter/m/f0a364/32.png) [@mpiggott](https://community.sonatype.com/u/mpiggott)\
**Post date:** [September 4, 2026, 2:19pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/12 "2026-09-04T14:19:08Z")

</div>

I understand, but have you tried the same process again this change doesn’t alter existing metadata.

---

<div class="post-metadata">

**Author:** ![Dark\_Jo](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@Dark\_Jo](https://community.sonatype.com/u/Dark_Jo)\
**Post date:** [September 4, 2026, 5:42pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/13 "2026-09-04T17:42:33Z")

</div>

I tried on a fresh instance and encounter the problem

---

<div class="post-metadata">

**Author:** ![Dark\_Jo](https://avatars.discourse-cdn.com/v4/letter/d/ecc23a/32.png) [@Dark\_Jo](https://community.sonatype.com/u/Dark_Jo)\
**Post date:** [September 15, 2026, 1:07pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/14 "2026-09-15T13:07:49Z")

</div>

Any news, this bug prevent me to choose Nexus Repository for my artifact repository manager and subscribe to the Pro license. I am considering watching some alternative right now

---

<div class="post-metadata">

**Author:** ![jzora](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/jzora/32/4197_2.png) [@jzora](https://community.sonatype.com/u/jzora)\
**Post date:** [September 17, 2026, 7:50pm UTC](https://community.sonatype.com/t/nexus-repository-does-not-respect-npm-semver-versionning/16545/15 "2026-09-17T19:50:55Z")

</div>

Hi! Unfortunately, we’re a little puzzled. Will you open an issue ([Issues · sonatype/nexus-public · GitHub](https://github.com/sonatype/nexus-public/issues)) and provide exact steps to reproduce this bug? The more detail you can give us there, the better.