nx release publish launch 'npm dist-tag add' command on a package version which does not exists on the npm registry

[Bare1337]

Current Behavior

During nx release publish execution and when there is only one version of the specified package on the remote registry, npm dist-tag add ${packageName}@${packageJson.version} ${tag} --"${registryConfigKey}=${registry}" is executed against a package version which does not exist in the registry.

In our case, it leads to an "unhandled" 400 error when it's executed with dist-tag "latest" on Sonatype Nexus Repository OSS 3.55.0-01.

Expected Behavior

When the current package version to publish is not found on the remote registry, nx release publish should not try to execute the command npm dist-tag add ${packageName}@${packageJson.version} ${tag} --"${registryConfigKey}=${registry}" and error out.

GitHub Repo

No response

Steps to Reproduce

1. Create a new package in an nx workspace and update package.json version of the package to "0.1.0-beta.0"
2. Execute nx release publish --tag=latest
3. Update the created package package.json version to "0.1.0"
4. Execute nx release publish --tag=latest

Nx Report

Node   : 20.9.0
OS     : win32-x64
pnpm   : 8.15.1

nx                 : 18.3.5
@nx/js             : 18.3.5
@nx/jest           : 18.3.5
@nx/linter         : 18.3.5
@nx/eslint         : 18.3.5
@nx/workspace      : 18.3.5
@nx/angular        : 18.3.5
@nx/cypress        : 18.3.5
@nx/devkit         : 18.3.5
@nx/eslint-plugin  : 18.3.5
@nrwl/tao          : 18.3.5
@nx/web            : 18.3.5
@nx/webpack        : 18.3.5
typescript         : 5.4.5

Failure Logs

No response

Package Manager Version

No response

Operating System

• macOS
• Linux
• Windows
• Other (Please specify)

Additional Information

The issue comes from the return type of the npm view command which is not consistent for the parsed "versions" key.

"versions" key return an array of string when there is more than one version published to the remote registry and a simple string while there is still only one version.

Hence if the versions key contains for example "0.1.0-beta.0" and i'am trying to publish "0.1.0", this part of the code:

nx/packages/js/src/executors/release-publish/release-publish.impl.ts

Line 113 in 7088b09

if (resultJson.versions.includes(currentVersion)) {

return true as it's a substring match.

We fixed it by preemptively adding a type check and reassigning the string value into an array before the check is executed.

I'am willing to submit a PR if necessary.

[JamesHenry]

Thank you for the write up @Bare1337, SMH at the different data type depending on the length... but I can indeed reproduce using a local verdaccio registry:

After one publish of a package

{ resultJson: { versions: '1.0.0', 'dist-tags': { latest: '1.0.0' } } }

After two publishes of a package

{
  resultJson: { versions: [ '1.0.0', '1.0.1' ], 'dist-tags': { latest: '1.0.1' } }
}

I will put up a quick PR now to normalize it on our side

[JamesHenry]

This will be resolved by #26496

[Bare1337]

Well, i have to admit you cannot and should NOT expect your return type is depending on the length... Thanks for your reactivity normalize it on your side tho.

[github-actions]

This issue has been closed for more than 30 days. If this issue is still occuring, please open a new issue with more recent context.