Skip to content

fix(outdated): report aliased global packages against the aliased registry name#9707

Open
Sanjays2402 wants to merge 1 commit into
npm:latestfrom
Sanjays2402:fix/issue-9706
Open

fix(outdated): report aliased global packages against the aliased registry name#9707
Sanjays2402 wants to merge 1 commit into
npm:latestfrom
Sanjays2402:fix/issue-9706

Conversation

@Sanjays2402

Copy link
Copy Markdown

Description

npm outdated -g reports the wrong package and the wrong target version for globally installed alias packages.

When you install a global alias such as npm install -g cat@npm:dog@1.0.1, the directory on disk is cat/ but package.json inside is { "name": "dog", "version": "1.0.1" }. outdated iterates the global root as node.children.values() (Nodes, not Edges), so edge.spec is undefined, and the existing alias-detection path (safeNpa(edge.spec)?.subSpec) is skipped. The packument fetch then falls through to the wrapper directory name (cat) instead of the aliased package (dog), and the row that prints to the user is essentially nonsense: the Current column shows the aliased package's installed version while Wanted / Latest come from the wrong packument.

This is the exact scenario in #9706, where the user installs cowsay@npm:typescript@5.0.0 and sees:

Package  Current  Wanted  Latest  Location             Depended by
cowsay     6.0.2   1.6.0   1.6.0  node_modules/cowsay  global

6.0.2 is typescript's installed version and 1.6.0 is cowsay's latest, so the row is mixing two different packages.

Fix

In #getOutdatedInfo, when edge.spec is missing (the global-Node case) and the wrapper directory name differs from the package's own name (node.name !== node.packageName), synthesize an npm:<packageName>@<version> spec and feed it through the existing alias code path. The packument now comes from the aliased package, Wanted / Latest resolve correctly, and the row label becomes <wrapper>@npm:<pkg>@<version> so the user can tell which on-disk package is being reported on.

The pre-existing local-alias path (edge.spec.replace('npm', edge.name) producing rows like cat:dog@^1.0.0) is untouched so existing snapshots and behavior are unchanged.

References

Fixes #9706

Test Coverage

Added a regression test global alias packages report alias spec, not aliased package version in test/lib/commands/outdated.js that:

  • Installs a global fixture where node_modules/cat/package.json is actually { name: 'dog', version: '1.0.1' } (the on-disk shape of npm install -g cat@npm:dog@1.0.1).
  • Runs outdated.exec([]) with config: { global: true }.
  • Asserts the row is identified as cat@npm:dog@1.0.1, the Current column reflects the alias, and the Latest column resolves to dog's latest (2.0.0) rather than cat's.

Verified the test fails on the base commit (all three assertions fail; no row is even produced) and passes with this fix. Full test/lib/commands/outdated.js suite (12 subtests) passes; no existing snapshots were touched. Lint clean.

AI disclosure

This change was written with the assistance of Claude. I have reviewed the diff and the test and take responsibility for the code.

…istry name

Closes npm#9706

When a package is installed globally via an alias spec
(`npm install -g cat@npm:dog@1.0.1`), the outdated command iterated
the global root's children as Nodes rather than Edges, so
`edge.spec` was undefined and the existing alias detection path was
skipped. The lookup then fell through to the wrapper directory name,
which either resolved against the wrong packument or produced no
row at all.

Detect this case by checking that the wrapper directory name
(`node.name`) differs from the actual package name
(`node.packageName`), synthesize an `npm:<pkg>@<version>` spec,
and reuse the existing alias code path so Wanted / Latest resolve
against the aliased package's packument. The row name now reads
`<wrapper>@npm:<pkg>@<version>` so users can tell which on-disk
package is being reported on.
@Sanjays2402 Sanjays2402 requested review from a team as code owners June 30, 2026 14:03
@liangmiQwQ

Copy link
Copy Markdown
Contributor

Thank you so much for resolving my issue!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Global alias packages have wrong outdated / update version

2 participants