shelljs Breaks SemVer for Alpha and Pre-Release Versions

[shane-walker]

npm published a change to their CDN configuration earlier today that exposed another issue with SemVer publishing via npm. As such, it would seem that shelljs is breaking some of the internet because of the alpha and pre-release versions that were published to NPM.

Would it be possible to get some of those versions unpublished and prevent future releases from breaking SemVer?

air:test_mar9 user$ nvm use 5.7.1
Now using node v5.7.1 (npm v3.6.0)
air:test_mar9 user$ npm install eslint
npm ERR! Darwin 15.3.0
npm ERR! argv "/Users/user/.nvm/versions/node/v5.7.1/bin/node" "/Users/user/.nvm/versions/node/v5.7.1/bin/npm" "install" "eslint"
npm ERR! node v5.7.1
npm ERR! npm  v3.6.0

npm ERR! Invalid Version: 0.0.6pre2
npm ERR!
npm ERR! If you need help, you may report this error at:
npm ERR!     <https://github.com/npm/npm/issues>

npm ERR! Please include the following file with any support request:
npm ERR!     /Users/user/test_mar9/npm-debug.log
air:test_mar9 user$ npm view shelljs versions

[ '0.0.1-alpha1',
  '0.0.1alpha1',
  '0.0.1',
  '0.0.2-pre1',
  '0.0.2pre1',
  '0.0.2',
  '0.0.3',
  '0.0.4pre1',
  '0.0.4-pre1',
  '0.0.4',
  '0.0.5pre1',
  '0.0.5-pre1',
  '0.0.5pre2',
  '0.0.5-pre2',
  '0.0.5-pre3',
  '0.0.5pre3',
  '0.0.5-pre4',
  '0.0.5pre4',
  '0.0.5',
  '0.0.6-pre1',
  '0.0.6pre1',
  '0.0.6-pre2',
  '0.0.6pre2',
  '0.0.6',
  '0.0.7',
  '0.0.8',
  '0.0.9',
  '0.1.0',
  '0.1.1',
  '0.1.2',
  '0.1.3',
  '0.1.4',
  '0.2.0',
  '0.2.1',
  '0.2.2',
  '0.2.3',
  '0.2.4',
  '0.2.5',
  '0.2.6',
  '0.3.0',
  '0.4.0',
  '0.5.0',
  '0.5.1',
  '0.5.2',
  '0.5.3',
  '0.6.0' ]

air:test_mar9 user$

[nfischer]

@shane-walker thanks for reporting this! @ariporad and I will investigate this and see if we can fix this today.

I'm seeing different output than you're seeing:

$ nvm use --delete-prefix 5.7.1
Now using node v5.7.1 (npm v3.6.0)

nate@lenovoyoga ~/foo
$ node -v
v5.7.1

nate@lenovoyoga ~/foo
$ npm -v
3.6.0

nate@lenovoyoga ~/foo
$ npm install eslint
[email protected] /home/nate/foo
└── [email protected]  extraneous

npm WARN [email protected] No description
npm WARN [email protected] No repository field.

nate@lenovoyoga ~/foo
$ npm view shelljs versions

[ '0.0.1-alpha1',
  '0.0.1',
  '0.0.2-pre1',
  '0.0.2',
  '0.0.3',
  '0.0.4-pre1',
  '0.0.4',
  '0.0.5-pre1',
  '0.0.5-pre2',
  '0.0.5-pre3',
  '0.0.5-pre4',
  '0.0.5',
  '0.0.6-pre1',
  '0.0.6-pre2',
  '0.0.6',
  '0.0.7',
  '0.0.8',
  '0.0.9',
  '0.1.0',
  '0.1.1',
  '0.1.2',
  '0.1.3',
  '0.1.4',
  '0.2.0',
  '0.2.1',
  '0.2.2',
  '0.2.3',
  '0.2.4',
  '0.2.5',
  '0.2.6',
  '0.3.0',
  '0.4.0',
  '0.5.0',
  '0.5.1',
  '0.5.2',
  '0.5.3',
  '0.6.0' ]

Does this issue still persist for you?

[shane-walker]

@nfischer It probably has something to do with them patching the CDN configuration earlier today. npm/npm#11836 (comment)

We run an NPM proxy that probably has the broken 'version' cached, which would account for the error continuing for me. I'll see if we can clear out the cache but, hopefully, if we can get those versions unpublished it shouldn't happen anymore. At least not for shelljs.

[nfischer]

@shane-walker Thanks for the reply. Just to clarify, the versions that should be unpublished (because they don't match the correct semver pattern) are:

• 0.0.1alpha1
• 0.0.2pre1
• 0.0.4pre1
• 0.0.5pre1
• 0.0.5pre2
• 0.0.5pre3
• 0.0.5pre4
• 0.0.6pre1
• 0.0.6pre2

Is that correct?

[shane-walker]

@nfischer yeah, those seem to be the problem children. While correct within SemVer standard, npm doesn't like them when doing strict comparisons.

[ariporad]

@shane-walker: I'm seeing the same as @nfischer:

 $ npm view shelljs versions
[ '0.0.1-alpha1',
  '0.0.1',
  '0.0.2-pre1',
  '0.0.2',
  '0.0.3',
  '0.0.4-pre1',
  '0.0.4',
  '0.0.5-pre1',
  '0.0.5-pre2',
  '0.0.5-pre3',
  '0.0.5-pre4',
  '0.0.5',
  '0.0.6-pre1',
  '0.0.6-pre2',
  '0.0.6',
  '0.0.7',
  '0.0.8',
  '0.0.9',
  '0.1.0',
  '0.1.1',
  '0.1.2',
  '0.1.3',
  '0.1.4',
  '0.2.0',
  '0.2.1',
  '0.2.2',
  '0.2.3',
  '0.2.4',
  '0.2.5',
  '0.2.6',
  '0.3.0',
  '0.4.0',
  '0.5.0',
  '0.5.1',
  '0.5.2',
  '0.5.3',
  '0.6.0' ]

[ariporad]

Same on http://semver.npmjs.com/.

[nfischer]

@ariporad I think it's safe to remove these, since it looks like these versions shouldn't be in use by people anyway (they're all alphas and pre releases). Normally, I would say we should deprecate, but since the existence of these might break other important packages, we should resolve this sooner rather than later.

I think the packages still exist, but npm servers aren't displaying them in the list.

[ariporad]

@nfischer: Done.

[ariporad]

Ok everyone, this should be resolved now, so I'm going to close this issue.

ShellJS just switched maintainers, and we'll defiantly be semver compliant going forward.

Please re-open if it's still problematic.

[arobson]

@ariporad thanks again for your prompt response and help with this! We really appreciate it.

[ariporad]

No problem!

Thanks! Ari
On Fri, Mar 11, 2016 at 12:28 PM, Alex Robson [email protected] wrote:
@ariporad [https://github.com/ariporad] thanks again for your prompt response and help with this! We really appreciate
it.

—
Reply to this email directly or view it on GitHub
[https://github.com//issues/390#issuecomment-195536755] .[https://github.com/notifications/beacon/ABu7pNdlTOmU15VCL9SXNrp0NKlkwbMKks5psdBbgaJpZM4HtK5g.gif]

[JonDuffy]

Hey, I'm still experiencing problems with this issue. Is there something I can do on my end to prevent it from happening?

[nfischer]

@JonDuffy Could you please provide the output of npm view shelljs versions? I can't see the invalid versions when I run that command.

[JonDuffy]

sure:

thanks for the quick response

npm view shelljs versions

[ '0.0.1-alpha1',
  '0.0.1alpha1',
  '0.0.1',
  '0.0.2-pre1',
  '0.0.2pre1',
  '0.0.2',
  '0.0.3',
  '0.0.4pre1',
  '0.0.4-pre1',
  '0.0.4',
  '0.0.5pre1',
  '0.0.5-pre1',
  '0.0.5pre2',
  '0.0.5-pre2',
  '0.0.5-pre3',
  '0.0.5pre3',
  '0.0.5-pre4',
  '0.0.5pre4',
  '0.0.5',
  '0.0.6-pre1',
  '0.0.6pre1',
  '0.0.6-pre2',
  '0.0.6pre2',
  '0.0.6',
  '0.0.7',
  '0.0.8',
  '0.0.9',
  '0.1.0',
  '0.1.1',
  '0.1.2',
  '0.1.3',
  '0.1.4',
  '0.2.0',
  '0.2.1',
  '0.2.2',
  '0.2.3',
  '0.2.4',
  '0.2.5',
  '0.2.6',
  '0.3.0',
  '0.4.0',
  '0.5.0',
  '0.5.1',
  '0.5.2',
  '0.5.3',
  '0.6.0' ]

[nfischer]

@JonDuffy Could you also please provide the output of npm config get registry? I think this may be an issue with inconsistencies between registries.

[JonDuffy]

Not sure I can send that, but we do have a private NPM repo (this is the only registry shown in the output)

[nfischer]

If there's a way you can change your registry, that should resolve the issue. npm config set registry https://registry.npmjs.org/.

I can reproduce this error when I use https://skimdb.npmjs.com/registry.

[JonDuffy]

Fixed this by removing shelljs from the private npm repo, forcing a download which does not contain the invalid versions