npm-publish icon indicating copy to clipboard operation
npm-publish copied to clipboard

Checking for npm package existence should ignore tag and check against all versions

Open rikoe opened this issue 3 years ago • 0 comments

The tag property is clearly needed when actually publishing a package, but I don't think it should be used for checking whether a package exists.

In fact, it looks like the current code just does npm view <package>@<tag> version, which will:

  1. say the package doesn't exist if the tag is different, or has previous been published with no tag (or is no longer "latest")
  2. say the package doesn't exist if the version isn't the most recent version for that tag

Both of these will result in false negatives, where it will then try to publish the package because it thinks it doesn't exist, but it actually does, and the publish will fail.

Instead, it should ignore the tag entirely, and just use npm view <package> versions, which returns all versions of the package, and then do a contains check to see if the version being checked matches any of them.

I would recommend using an existing dependency for this, e.g. https://github.com/azu/can-npm-publish

rikoe avatar Apr 15 '21 00:04 rikoe