npm's "latest" Is a Label a Maintainer Sets. PyPI's and crates.io's Is Just Math.

说明与用途

在 npm 中，"latest" 标签是维护者可变更的标记，而 PyPI 和 crates.io 会自动选择最高稳定版本。将 npm latest 视为最新版本的工具可能会报告错误的依赖信息。

问题

Tooling that assumes npm's "latest" tag represents the newest version can misreport or ignore prerelease channels, leading to incorrect dependency audits.

结果

npm’s latest tag is a mutable label set by maintainers, whereas PyPI and crates.io compute the highest stable version deterministically. Tooling that assumes npm’s latest equals the newest version can misreport dependencies.

工作流

• 1. Scrape npm, PyPI, and crates.io registries for package metadata.
• 2. Compare the "latest" tag (npm) or highest stable version (PyPI, crates.io) with the highest published version.
• 3. Identify mismatches where npm's latest tag points to a lower version than a newer prerelease.
• 4. Verify that only npm allows a maintainer to set the latest tag arbitrarily.
• 5. Document the differences in how each registry handles default version selection.

证据

npm's "latest" isn't computed. It's a label.

来源

Only vue had it. I'd have bet on react too, and I'd have lost: its canary builds are all 19.3.0-canary-…

来源

pip install black resolves to whatever PEP 440 says is the highest stable version number, full stop

来源

cargo computes "the newest usable version" itself, client-side, as the highest non-yanked semver that satisfies whatever range your Cargo.toml asked for

来源