[BUG] npm audit fix does semver-breaking updates for 0-versioned packages

[DullReferenceException]

What / Why

npm audit fix erroneously does non-semver-compatible bumps for 0-prefixed versions.

When

Always

Where

npm public registry

How

Current Behavior

Running npm audit fix causes bad, semver-breaking bumps. For example, soap being on version 0.23.0 gets a bump to 0.30.0. This same issue has been observed for packages like axios as well.

Steps to Reproduce

run npm audit fix with 0-versioned packages containing vulnerabilities

Expected Behavior

npm should refuse to do automatic bumps like this, since according to semver, 0.23.0 and 0.30.0 are not compatible, since the second number for zero versions is considered a major bump.

[DullReferenceException]

Was this fixed?

[ljharb]

@DullReferenceException which version of npm did you run into this with? if it's latest npm 7, i'll reopen it.

[DullReferenceException]

Looks like it's fixed in npm 7, sweet!