Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Fix npm published version number

See original GitHub issue

Issue Description

Actual Behaviour

If you run npm audit

$ npm audit

                       === npm audit security report ===

# Run  npm install --save-dev serverless-dynamodb-local@1.0.2  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
│ Moderate      │ Prototype Pollution                                          │
│ Package       │ node.extend                                                  │
│ Dependency of │ serverless-dynamodb-local [dev]                              │
│ Path          │ serverless-dynamodb-local > dynamodb-localhost > rmdir >     │
│               │ node.flow > node.extend                                      │
│ More info     │                             │

It advises you to instal: npm install --save-dev serverless-dynamodb-local@1.0.2

Expected Behaviour

It should offer to install the verson 0.2.37 as that is the latest version of the package. This is because npm registry version has 1.0.0, 1.0.1 and 1.0.2 version published 3 years ago.

Screenshot 2019-04-07 at 08 47 02

Steps to reproduce it

run npm audit

Would you like to work on the issue?

May be, it require npm publish access to fix this issue.

Potential options:

  1. Depricate npm releases 1.0.0, 1.0.1 and 1.0.2.
  2. Release a new version 1.2.38

I know that option 2 is against how semver works. In this case publishing those 1.x version has lead to this issue. However this will set things on the right track for future releases. Essentially you are doing a fake release to realign semver releases.

Issue Analytics

  • State:open
  • Created 4 years ago
  • Reactions:8
  • Comments:6

github_iconTop GitHub Comments

azizurcommented, Apr 21, 2019

@AshanFernando Any update on this?

marty331commented, Apr 30, 2019

This issue is effecting my team as well, any update on it’s completion?

Read more comments on GitHub >

github_iconTop Results From Across the Web

About semantic versioning - npm Docs
Incrementing semantic versions in published packages ; First release, New product, Start with 1.0.0, 1.0.0 ; Backward compatible bug fixes, Patch release ......
Read more >
How do I update an NPM module that I published?
To change the version number in package.json, on the command line, in the package root directory, run the following command, replacing < ...
Read more >
How to Publish an Updated Version of an npm Package
The easiest way to update your version number is to use the handy npm version command. This will automatically update the version number...
Read more >
How to Use Semantic Versioning in NPM |
The Node Package Manager (npm) ecosystem uses Semantic Versioning, or SemVer, as the standard for version numbers. By default, when installing an npm...
Read more >
How to automate versioning and publication of an npm package
Take into account that standard-version will change your version number following these guides: A git commit -m “fix: …
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Post

No results found

github_iconTop Related Hashnode Post

No results found