Fractal: npm audit tells me to install version 3.0.0 while the latest version is 1.1.7

[frankvaneykelen]

Description

When I run npm audit it tells me to install version 3.0.0 (Run npm install --save-dev @frctl/[email protected] to resolve 8 vulnerabilities), but that is actually a very old release (published on npm 3 years ago) with a faulty version number.

Steps to Reproduce

1. npm audit

Expected behavior (upgrade to latest version 1.1.7):

=== npm audit security report ===                        

# Run  npm install --save-dev @frctl/[email protected]  to resolve 8 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change

Actual behavior:

=== npm audit security report ===                        

# Run  npm install --save-dev @frctl/[email protected]  to resolve 8 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change

Reproduces how often:

Always

Versions

• What version of Fractal are you running?
  @frctl/[email protected]
• What version of Node.js are you running? (run node -v)
  v11.11.0

Additional Information

Version 3.0.0 was published between 0.2.2 and 0.3.0, so it obviously was a typo in the version number.

[timseverien]

Note that unpublishing packages on npm isn't easy. Considering 3.0.0 was published a long time ago, it can't be unpublished:

[U]npublish is only allowed with versions published in the last 72 hours.

https://docs.npmjs.com/cli/unpublish#description

It gets worse: according to the docs, version 3.0.0 can't be reused ever again:

Even if a package version is unpublished, that specific name and version combination can never be reused.

https://docs.npmjs.com/cli/unpublish#description

Considering the popularity of @frcl/fractal, the npm staff might just make an exception and completely delete the version. Either way, I suppose an owner should get in touch with npm support and ask for help.

If, for whatever reason, npm support refuses to unpublish the package, the package owner could deprecate the package so hopefully it won't show up in an npm audit.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[frankvaneykelen]

Did an owner "get in touch with npm support and ask for help" yet?

[LeBenLeBen]

I don't think so, I'll see what I can do.

[LeBenLeBen]

@Chapabu Please contact npm support and keep us updated 🙇

[Chapabu]

Version 3.0.0 has been deprecated. NPM won't remove released packages :(

[frankvaneykelen]

Thanks. That fixed my problem - it now suggests to install the proper latest version:

npm install --save-dev @frctl/[email protected]