2.0.0-beta.3 published as latest in npm

I upgraded cookie-session in my app today and noticed that the beta version is marked as latest in npm instead of the stable version 1.3.2. I would assume that beta versions would be published under the next dist tag or similar. Is installing the beta version by default intentional?

[dougwilson]

Thanks, @Hilzu . I looked around as well and even found https://medium.com/@mbostock/prereleases-and-npm-e778fc5e2420 . No wonder I’ve just use npm publish for all these 5+ years without realizing there was an issue. When I first started out it behaved differently than it apparently does today. Now you are required to publish with these tags in order for it not to be a default install.

Not sure what people use, because I’ve had the beta published up since Oct 2015 and I think this is the first issue, so it must not affect very many people, or a lot of people have installed the beta now and so reverting to the behavior you’re expecting may be unexpected to them. I think at this point it’s safer to leave as-is and note this for the future.

[Hilzu]

Beta versions are commonly published with the next dist tag: https://docs.npmjs.com/cli/dist-tag#purpose

Because the beta is published under the latest tag it’s the version that gets installed with npm install cookie-session. That’s surprising at least to me. I would expect that a stable version would be the one installed by default.