0

What will happen if the "package.json" version is not followed in sequence and the same version is repeated in the history with different code-base?

Let us suppose:

  • Project-XYZ package.json version 1.0.0 is published with the changes in the files (file1, file2)
  • Project-XYZ package.json version 1.1.0 is published with the changes in the files (file2, file3)
  • Project-XYZ package.json version 2.0.0 is published with the changes in the files (file3, file1)
  • Project-XYZ package.json version 1.0.0 is published with the changes in the files (file4, file2)
  • Project-XYZ package.json version 1.0.1 is published with the changes in the files (file5, file1)
  • Project-XYZ package.json version 1.0.2 is published with the changes in the files (file2, file1)
  • Project-XYZ package.json version 1.1.0 is published with the changes in the files (file1, file2)
  • Project-XYZ package.json version 2.0.0 is published with the changes in the files (file4, file5)

package.json version 1.0.0 is published twice with the different codebase, should this work or would it cause any problem.

I am actually experiencing an error called Timeout._onTimeout after particular commit in the Gitlab pipeline but the only difference I could see in the code was this versioning order, it is certain that the engineer missed the actual version and tried pushing on the older version only and since then on the sequence continued for the same versions in the history repeating with the different codebase.

should this cause any problem ? have any of you come across such a scenario?

Please help. Thanks in advance!

kavigun
  • 2,219
  • 2
  • 14
  • 33

1 Answers1

0

I found an answer on npmjs docs and it says:

  • Fails if the package name and version combination already exists in the specified registry.

  • Once a package is published with a given name and version, that specific name and version combination can never be used again, even if it is removed with npm-unpublish.

  • As of npm@5, both a sha1sum and an integrity field with a sha512sum of the tarball will be submitted to the registry during publication. Subsequent installs will use the strongest supported algorithm to verify downloads.

So, clearly we can't have such versioning and I will try and fix the above issue moving the code-based to new and unused versions.

Community
  • 1
  • 1
kavigun
  • 2,219
  • 2
  • 14
  • 33