Repository navigation
package.json: reject empty "version" string - #6421
Merged
hyperupcall merged 2 commits intoSep 28, 2026
Merged
Conversation
simin-yuan
requested review from
hyperupcall and
madskristensen
as code owners
September 27, 2026 13:23
Contributor
|
Thanks for the PR! This section of the codebase is owned by @madskristensen and |
Member
|
Thanks, this is great. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
"version": ""currently validates against thepackage.jsonschema, but npm refuses it:An empty string is also not parsable by node-semver, which is what the field's own description requires. This adds
"minLength": 1toversion, matching the existing constraint onname.Scope is deliberately minimal:
versionstays optional (private packages and workspace roots legitimately omit it); only the empty string is rejected.patternis added, to avoid rejecting any version string node-semver accepts.Tests: new negative test
src/negative_test/package/version-empty-string.json. It validates against the current schema and is rejected with this change; the existing positive and negative tests underpackage/are unaffected.Found by mutation-testing the schema against a real
package.jsonwith greencheck; details in its third-party case study.