fix(@angular/cli): robustly parse npm manifest from array#33147
Merged
clydin merged 2 commits intoangular:mainfrom May 7, 2026
Merged
fix(@angular/cli): robustly parse npm manifest from array#33147clydin merged 2 commits intoangular:mainfrom
clydin merged 2 commits intoangular:mainfrom
Conversation
Update `parseNpmLikeManifest` to find the manifest with the highest version instead of assuming the last item in the array is the correct one. This makes the parsing robust against out-of-order results from `npm view` or similar commands without incurring performance penalties. This change ensures that the latest relevant version is always selected when a range is queried and multiple versions are returned, improving reliability in edge cases where registry output might not be sorted.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the parseNpmLikeManifest function to handle multiple manifests by selecting the highest versioned entry, supported by a new validation helper and expanded unit tests. Review feedback suggests further strengthening the validation logic to verify semantic version formats using the semver package, refining debug log messages for clarity, and adding test coverage for invalid version strings.
clydin
force-pushed
the
fix/cli/robust-npm-manifest-parsing
branch
2 times, most recently
from
c6cf19b to
07ce1e4
Compare
clydin
added
the
action: review
alan-agius4
approved these changes
May 7, 2026
Collaborator
alan-agius4
left a comment
alan-agius4
left a comment
There was a problem hiding this comment.
LGTM, after the lint issue is fixed.
alan-agius4
added
action: cleanup
1 task
clydin
added
action: merge
clydin
force-pushed
the
fix/cli/robust-npm-manifest-parsing
branch
from
07ce1e4 to
4f0385f
Compare
…rsing Introduce a reusable `isValidManifest` type guard to ensure that parsed manifests contain both `name` and `version` strings. This applies to both single object responses and elements within an array response from the package manager.
clydin
force-pushed
the
fix/cli/robust-npm-manifest-parsing
branch
from
4f0385f to
4a78ddc
Compare
Member
Author
|
Hey there, thanks for your quick response to issue #33146 and implementing a fix. I see that you only added validation steps to the final PR that was merged into main and 21.2.x. But the key problem - sorting for the latest version - that you initially fixed in 5c1db4e (Line 241 to 257) was not picked for the final PR. Why is that? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update
parseNpmLikeManifestto find the manifest with the highest version instead of assuming the last item in the array is the correct one. This makes the parsing robust against out-of-order results fromnpm viewor similar commands without incurring performance penalties.This change ensures that the latest relevant version is always selected when a range is queried and multiple versions are returned, improving reliability in edge cases where registry output might not be sorted.