npm: minimum_release_age installs prerelease #9503

180254 · 2026-05-01T06:07:28Z

180254
May 1, 2026

npm: minimum_release_age installs prerelease

For the npm: backend, setting MISE_MINIMUM_RELEASE_AGE causes mise to ignore Semantic Versioning rule 9 and install a pre-release instead of the latest matching stable release.

mise --version
# 2026.4.28 linux-x64 (2026-04-30)

mise install core:node
mise use node
node --version
# v25.9.0

mise install 'npm:@google/gemini-cli@latest'
# Resolving @google/[email protected] ...   ✓

mise uninstall 'npm:@google/gemini-cli'
mise cache clear
export MISE_MINIMUM_RELEASE_AGE=0d # expected: effectively no-op
mise install 'npm:@google/gemini-cli@latest'
# Resolving @google/[email protected] ... 

mise uninstall 'npm:@google/gemini-cli'
mise cache clear
export MISE_MINIMUM_RELEASE_AGE=3d
mise install 'npm:@google/gemini-cli@latest'
# Resolving npm:@google/[email protected] ...

$ mise doctor
version: 2026.4.28 linux-x64 (2026-04-30)
activated: yes
shims_on_path: no
self_update_available: yes

build_info:
  Target: x86_64-unknown-linux-gnu
  Features: OPENSSL, RUSTLS_NATIVE_ROOTS, SELF_UPDATE
  Built: Thu, 30 Apr 2026 10:54:56 +0000
  Rust Version: rustc 1.95.0 (59807616e 2026-04-14)
  Profile: release

shell:
  bash
  GNU bash, version 5.3.9(1)-release (x86_64-pc-linux-gnu)
  Copyright (C) 2025 Free Software Foundation, Inc.
  License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

  This is free software; you are free to change and redistribute it.
  There is NO WARRANTY, to the extent permitted by law.

aqua:
  baked in registry: aquaproj/[email protected]
  baked in registry tools: 2159

dirs:
  cache: ~/.cache/mise
  config: ~/.config/mise
  data: ~/.local/share/mise
  shims: ~/.local/share/mise/shims
  state: ~/.local/state/mise

config_files:
  /mise.toml

env_files:
  (none)

ignored_config_files: (none)

backends:
  aqua
  asdf
  cargo
  conda
  core
  dotnet
  forgejo
  gem
  github
  gitlab
  go
  npm
  pipx
  spm
  http
  s3
  ubi
  vfox

plugins:

toolset:
  core:[email protected]

path:
  ~/.local/share/mise/installs/node/latest/bin
  ~/.local/bin/
  /usr/local/sbin
  /usr/local/bin
  /usr/sbin
  /usr/bin
  /sbin
  /bin

env_vars:
  MISE_MINIMUM_RELEASE_AGE=0d
  MISE_SHELL=bash

settings:

No problems found

jdx · 2026-05-01T15:34:27Z

jdx
May 1, 2026
Maintainer

Thanks for the detailed reproducer.

Root cause: when minimum_release_age is set (even to 0d), latest version resolution skips the backend fast path (latest_stable_version, which for npm asks for the latest dist-tag) and falls back to the shared version-list path. That path relies on a regex (VERSION_REGEX) to flag pre-releases for backends like npm: that do not provide a prerelease flag in their listing. The regex catches -rc, -beta, -alpha, -pre, -dev, -next, etc., but did not catch the -nightly, -canary, -experimental, -insider, or -edge channel tags that several large npm packages publish — so the 0.42.0-nightly... tarball slipped through and ended up being chosen as latest.

Fix: added those channel tags to VERSION_REGEX so they are filtered out of latest resolution on every backend that opts into pattern-based prerelease detection. PR: #9523.

With the fix, your reproducer resolves latest to 0.40.1 whether or not MISE_MINIMUM_RELEASE_AGE is set, matching the npm latest dist-tag.

This comment was generated by an AI coding assistant.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

npm: minimum_release_age installs prerelease #9503

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

npm: minimum_release_age installs prerelease #9503

Uh oh!

180254 May 1, 2026

npm: minimum_release_age installs prerelease

Replies: 1 comment

Uh oh!

jdx May 1, 2026 Maintainer

180254
May 1, 2026

jdx
May 1, 2026
Maintainer