fix: resolve semantic versioning issue by ElshadHu · Pull Request #2383 · npmx-dev/npmx.dev

ElshadHu · 2026-04-05T01:14:20Z

🔗 Linked issue

🧭 Context

Requesting a non-existent package version (e.g. /package/axios/v/150.150.150) returned HTTP 200 instead of 404. The page was silently showing content as if the version existed.

Added version validation in useResolvedVersion and unit tests to cover the fix.

📚 Description

The npm.antfu.dev API (fast-npm-meta) echoes back any version string without validating it against the registry. For non-existent versions it returns a 200 response but omits publishedAt. Because the fetch succeeded and returned a truthy version string, the existing 404 guards in the page never triggered.

The fix adds a check in useResolvedVersion: when an exact version is requested (starts with a digit) and the response has no publishedAt, a second request is made to the /versions/ endpoint on the same API to confirm the version actually exists. If it does not, the composable returns undefined, which the existing 404 guards in [name].vue already handle correctly - both on the server (throwing a 404) and on the client (showing the error page).

Dist-tags (latest, next) and semver ranges start with a letter and skip this check since they resolve to a different version string by design.

Files changed:

useResolvedVersion.ts - added registry validation when publishedAt is absent
use-resolved-version.spec.ts - added unit tests covering valid versions, non-existent versions, old versions without publishedAt, dist-tags, and scoped packages

vercel · 2026-04-05T01:14:26Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview, Comment	Apr 5, 2026 1:27am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	Apr 5, 2026 1:27am
npmx-lunaria	Ignored		Apr 5, 2026 1:27am

github-actions · 2026-04-05T01:14:49Z

Hello! Thank you for opening your first PR to npmx, @ElshadHu! 🚀

Here’s what will happen next:

Our GitHub bots will run to check your changes.
If they spot any issues you will see some error messages on this PR.
Don’t hesitate to ask any questions if you’re not sure what these mean!
In a few minutes, you’ll be able to see a preview of your changes on Vercel
One or more of our maintainers will take a look and may ask you to make changes.
We try to be responsive, but don’t worry if this takes a few days.

codecov · 2026-04-05T01:16:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

coderabbitai · 2026-04-05T01:19:42Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a5448a74-d204-487b-bb24-e7885f1a4d72

📥 Commits

Reviewing files that changed from the base of the PR and between f7734e7 and 8357506.

📒 Files selected for processing (2)

app/composables/npm/useResolvedVersion.ts
test/nuxt/composables/use-resolved-version.spec.ts

🚧 Files skipped from review as they are similar to previous changes (1)

app/composables/npm/useResolvedVersion.ts

📝 Walkthrough

Walkthrough

The PR updates the useResolvedVersion Nuxt composable to add semver validation and an additional fetch to the npm versions list when an exact name@version request returns a payload without publishedAt. If the versions list does not include the requested exact version the composable returns undefined; otherwise it returns data.version as before. The async data keying and default useAsyncData behaviour remain unchanged. A Vitest suite was added to cover multiple resolution scenarios, dist-tags and scoped package names.

Possibly related PRs

fix: update isr configuration for package pages #1604: Previous changes to useResolvedVersion that introduced useAsyncData and the data.version return pattern this PR extends.
fix: use resolvedVersion on package page to display data correctly #1969: Consumes resolvedVersion in package-page rendering; changes here affect that consumption and rendering logic.
fix(ui): the install command should use the correct version #1958: Builds install command using resolvedVersion; its behaviour is directly impacted by the new validation and fallback fetch.

Suggested reviewers

danielroe
ghostdevv
43081j

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The PR description clearly describes the changeset, providing context about the bug (non-existent versions returning HTTP 200), the root cause, and the fix implemented in useResolvedVersion.ts and corresponding tests.
Linked Issues check	✅ Passed	The PR implementation addresses issue `#2342` by validating non-existent exact versions through a secondary API call to /versions/ endpoint when publishedAt is absent, returning undefined for non-existent versions to trigger existing 404 handling.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing issue `#2342`: modifications to useResolvedVersion.ts add semver validation logic, and the new test file provides comprehensive test coverage for the fix with no unrelated changes detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

test/nuxt/composables/use-resolved-version.spec.ts (1)

120-137: Add a regression case for digit-prefixed non-exact specifiers.

This segment validates letter-prefixed tags only. Please add a case like requestedVersion = '1.x' with publishedAt: null to lock in the intended “no exact-version cross-check” behaviour for non-exact specifiers.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0d991eb1-3252-4b5a-8ec5-655a5fd2b41d

📥 Commits

Reviewing files that changed from the base of the PR and between eb4d862 and f7734e7.

📒 Files selected for processing (2)

app/composables/npm/useResolvedVersion.ts
test/nuxt/composables/use-resolved-version.spec.ts

app/composables/npm/useResolvedVersion.ts

ghostdevv · 2026-04-05T01:58:50Z

app/composables/npm/useResolvedVersion.ts

+      // The fast-npm-meta API echoes back non-existent exact versions without
+      // error (no publishedAt, no validation). When publishedAt is missing for
+      // an exact version request, cross-check the versions list to confirm the
+      // version actually exists in the registry.


I'd almost rather fix this upstream, want to make a PR?

Sure, I can make a PR.

I made a PR in upstream, if there is any issue, please let me know

ghostdevv · 2026-04-05T03:29:32Z

I'll close this in anticipation of antfu/fast-npm-meta#37 being merged - if that isn't then we can revisit this 🙏

fix: resolve semantic versioning issue

f7734e7

vercel bot deployed to Preview – npmx.dev April 5, 2026 01:16 View deployment

coderabbitai bot reviewed Apr 5, 2026

View reviewed changes

app/composables/npm/useResolvedVersion.ts Outdated Show resolved Hide resolved

chore: replace regex with semver.valid

8357506

vercel bot deployed to Preview – npmx.dev April 5, 2026 01:27 View deployment

ghostdevv requested changes Apr 5, 2026

View reviewed changes

ElshadHu mentioned this pull request Apr 5, 2026

fix: return 404 when requesting not existing exact version antfu/fast-npm-meta#37

Open

ghostdevv closed this Apr 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: resolve semantic versioning issue#2383

fix: resolve semantic versioning issue#2383
ElshadHu wants to merge 2 commits intonpmx-dev:mainfrom
ElshadHu:fix-semantic-versioning

ElshadHu commented Apr 5, 2026

Uh oh!

vercel bot commented Apr 5, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 5, 2026

Uh oh!

codecov bot commented Apr 5, 2026

Uh oh!

coderabbitai bot commented Apr 5, 2026 •

edited

Loading

Walkthrough

Possibly related PRs

Suggested reviewers

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

ghostdevv Apr 5, 2026

Uh oh!

ElshadHu Apr 5, 2026

Uh oh!

ElshadHu Apr 5, 2026

Uh oh!

ghostdevv commented Apr 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ElshadHu commented Apr 5, 2026

🔗 Linked issue

🧭 Context

📚 Description

Uh oh!

vercel bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 5, 2026

Uh oh!

codecov bot commented Apr 5, 2026

Codecov Report

Uh oh!

coderabbitai bot commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Possibly related PRs

Suggested reviewers

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ghostdevv Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

ElshadHu Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

ElshadHu Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

ghostdevv commented Apr 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel bot commented Apr 5, 2026 •

edited

Loading

coderabbitai bot commented Apr 5, 2026 •

edited

Loading