npm's "latest" Is a Label a Maintainer Sets. PyPI's and crates.io's Is Just Math.

Описание и применение

В npm тег "latest" является изменяемой меткой, которую может установить автор пакета, в то время как PyPI и crates.io автоматически выбирают самую высокую стабильную версию. Инструменты, полагающиеся на npm latest как на самую новую версию, могут выдавать неверные данные о зависимостях.

Задача

Tooling that assumes npm's "latest" tag represents the newest version can misreport or ignore prerelease channels, leading to incorrect dependency audits.

Результат

npm’s latest tag is a mutable label set by maintainers, whereas PyPI and crates.io compute the highest stable version deterministically. Tooling that assumes npm’s latest equals the newest version can misreport dependencies.

Рабочий процесс

• 1. Scrape npm, PyPI, and crates.io registries for package metadata.
• 2. Compare the "latest" tag (npm) or highest stable version (PyPI, crates.io) with the highest published version.
• 3. Identify mismatches where npm's latest tag points to a lower version than a newer prerelease.
• 4. Verify that only npm allows a maintainer to set the latest tag arbitrarily.
• 5. Document the differences in how each registry handles default version selection.

Доказательства

npm's "latest" isn't computed. It's a label.

Источник

Only vue had it. I'd have bet on react too, and I'd have lost: its canary builds are all 19.3.0-canary-…

Источник

pip install black resolves to whatever PEP 440 says is the highest stable version number, full stop

Источник

cargo computes "the newest usable version" itself, client-side, as the highest non-yanked semver that satisfies whatever range your Cargo.toml asked for

Источник