semver + latest with NPM dependencies

Question

A valid NPM dependency might look like:

dependencies:{
  "lodash":"latest"
}

but I use semver like this:

semver.eq('2.1.3','latest');

then I get:

TypeError: Invalid Version: latest

is there a way to handle 'latest' with semver or just ad-hoc?

Answer 1

Is there a way to handle 'latest' with semver ....?

No, not using the semver package itself as it doesn't know what 'latest' is. Metadata stored in the npm registry associates 'latest' for a given package with a semver.

Consider shelling out the npm-view command, using execSync() or exec(), to retrieve the 'latest' semver for the package in the npm registry ¹. Then pass the returned value as the second argument to thesemver.eq(...) comparison.

For example:

const semver = require('semver');
const execSync = require('child_process').execSync;

function getLatestVersion(pkg) {
  return JSON.parse(execSync(`npm view ${pkg} version --json`,
      { stdio: ['ignore', 'pipe', 'pipe'] }).toString());
}

const isEqual = semver.eq('2.1.3', getLatestVersion('lodash'));
console.log(isEqual); // --> false

---

1. _{As you know yourself from a previous question here. Exactly what the 'latest' version resolves to, whether it's 'stable', 'alpha', 'beta', 'rc', etc can vary. However, if the package owner has correctly published updates it's most likely to be 'stable'.}