npm / npm/cli

[BUG] NPM audit command fail with Invalid Version error

Open
#4,947 13 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

When I run sudo npm audit fix it fails like so:

zaci_dev@b5268ab2ee19:/home/amk/appliance/src/zaci_sw/bcSW/bc-reactux/appliance-react-ui$ sudo npm audit fix
npm ERR! Invalid Version: ^5.2.0

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2022-05-26T21_04_56_010Z-debug.log

Upon looking at the logs, this is what I get:

64 verbose stack TypeError: Invalid Version: ^5.2.0
64 verbose stack     at new SemVer (/usr/local/lib/nodejs/node-v16.13.2-linux-s390x/lib/node_modules/npm/node_modules/semver/classes/semver.js:38:13)
64 verbose stack     at compare (/usr/local/lib/nodejs/node-v16.13.2-linux-s390x/lib/node_modules/npm/node_modules/semver/functions/compare.js:3:32)
64 verbose stack     at Object.gte (/usr/local/lib/nodejs/node-v16.13.2-linux-s390x/lib/node_modules/npm/node_modules/semver/functions/gte.js:2:30)
64 verbose stack     at CanPlaceDep.checkCanPlaceCurrent (/usr/local/lib/nodejs/node-v16.13.2-linux-s390x/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/can-place-dep.js:173:51)
64 verbose stack     at CanPlaceDep.checkCanPlace (/usr/local/lib/nodejs/node-v16.13.2-linux-s390x/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/can-place-dep.js:157:27)
64 verbose stack     at new CanPlaceDep (/usr/local/lib/nodejs/node-v16.13.2-linux-s390x/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/can-place-dep.js:114:26)
64 verbose stack     at PlaceDep.place (/usr/local/lib/nodejs/node-v16.13.2-linux-s390x/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/place-dep.js:121:19)
64 verbose stack     at new PlaceDep (/usr/local/lib/nodejs/node-v16.13.2-linux-s390x/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/place-dep.js:71:10)
64 verbose stack     at /usr/local/lib/nodejs/node-v16.13.2-linux-s390x/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:944:31
64 verbose stack     at Array.map (<anonymous>)
65 verbose cwd /home/amk/appliance/src/zaci_sw/bcSW/bc-reactux/appliance-react-ui
66 verbose Linux 5.4.0-86-generic
67 verbose argv "/usr/local/lib/nodejs/node-v16.13.2-linux-s390x/bin/node" "/usr/bin/npm" "audit" "fix"
68 verbose node v16.13.2
69 verbose npm  v8.1.2
70 error Invalid Version: ^5.2.0
Expected Behavior

The command should try to fix vulnerabilities and if manual fix is needed. user should be informed in subsequent output.

Steps To Reproduce
  1. In Ubuntu 20.04 on s390 machine
  2. Using node v16.13.2 and npm v8.1.2
  3. Run 'sudo npm audit fix'
  4. See error mentioned above
Environment
  • npm: 8.1.2
  • Node.js: 16.13.2
  • OS Name: Ubuntu 20.04 (Docker and Host)
  • System Model Name: s390
  • npm config:
zaci_dev@b5268ab2ee19:/home/amk/appliance/src/zaci_sw/bcSW/bc-reactux/appliance-react-ui$ sudo npm config ls
; node bin location = /usr/local/lib/nodejs/node-v16.13.2-linux-s390x/bin/node
; cwd = /home/amk/appliance/src/zaci_sw/bcSW/bc-reactux/appliance-react-ui
; HOME = /root

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce npm audit fix with Node.js 16.13.2 and npm 8.1.2 on the reported s390 Ubuntu environment, then trace the stack through @npmcli/arborist/lib/can-place-dep.js, place-dep.js, and build-ideal-tree.js. Compare the semver call handling ^5.2.0; done means the command no longer aborts with Invalid Version and reports any manual fixes needed.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.