npm's "latest" Is a Label a Maintainer Sets. PyPI's and crates.io's Is Just Math.

Description and use

In npm, the "latest" tag is a mutable label set by maintainers, whereas PyPI and crates.io deterministically select the highest stable version. Tools that treat npm latest as the newest version can report incorrect dependency data.

Problem

Tooling that assumes npm's "latest" tag represents the newest version can misreport or ignore prerelease channels, leading to incorrect dependency audits.

Outcome

npm’s latest tag is a mutable label set by maintainers, whereas PyPI and crates.io compute the highest stable version deterministically. Tooling that assumes npm’s latest equals the newest version can misreport dependencies.

Workflow

• 1. Scrape npm, PyPI, and crates.io registries for package metadata.
• 2. Compare the "latest" tag (npm) or highest stable version (PyPI, crates.io) with the highest published version.
• 3. Identify mismatches where npm's latest tag points to a lower version than a newer prerelease.
• 4. Verify that only npm allows a maintainer to set the latest tag arbitrarily.
• 5. Document the differences in how each registry handles default version selection.

Evidence

npm's "latest" isn't computed. It's a label.

Source

Only vue had it. I'd have bet on react too, and I'd have lost: its canary builds are all 19.3.0-canary-…

Source

pip install black resolves to whatever PEP 440 says is the highest stable version number, full stop

Source

cargo computes "the newest usable version" itself, client-side, as the highest non-yanked semver that satisfies whatever range your Cargo.toml asked for

Source