Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Fix npm published version number

See original GitHub issue

Actual Behaviour

If you run npm audit

$ npm audit

                       === npm audit security report ===

# Run  npm install --save-dev serverless-dynamodb-local@1.0.2  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ node.extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ serverless-dynamodb-local [dev]                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ serverless-dynamodb-local > dynamodb-localhost > rmdir >     │
│               │ node.flow > node.extend                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/781                             │
└───────────────┴──────────────────────────────────────────────────────────────┘

It advises you to instal: npm install --save-dev serverless-dynamodb-local@1.0.2

Expected Behaviour

It should offer to install the verson 0.2.37 as that is the latest version of the package. This is because npm registry version has 1.0.0, 1.0.1 and 1.0.2 version published 3 years ago.

Steps to reproduce it

run npm audit

Would you like to work on the issue?

May be, it require npm publish access to fix this issue.

Potential options:

Depricate npm releases 1.0.0, 1.0.1 and 1.0.2.
Release a new version 1.2.38

I know that option 2 is against how semver works. In this case publishing those 1.x version has lead to this issue. However this will set things on the right track for future releases. Essentially you are doing a fake release to realign semver releases.

Issue Analytics

State:
Created 4 years ago
Reactions:8
Comments:6

Top GitHub Comments

5reactions

azizurcommented, Apr 21, 2019

@AshanFernando Any update on this?

3reactions

marty331commented, Apr 30, 2019

This issue is effecting my team as well, any update on it’s completion?

Top Results From Across the Web

About semantic versioning - npm Docs

Incrementing semantic versions in published packages ; First release, New product, Start with 1.0.0, 1.0.0 ; Backward compatible bug fixes, Patch release ......

How do I update an NPM module that I published?

To change the version number in package.json, on the command line, in the package root directory, run the following command, replacing < ...

How to Publish an Updated Version of an npm Package

The easiest way to update your version number is to use the handy npm version command. This will automatically update the version number...

How to Use Semantic Versioning in NPM | heynode.com

The Node Package Manager (npm) ecosystem uses Semantic Versioning, or SemVer, as the standard for version numbers. By default, when installing an npm...

How to automate versioning and publication of an npm package

Take into account that standard-version will change your version number following these guides: A git commit -m “fix: …