Security News
ESLint is Now Language-Agnostic: Linting JSON, Markdown, and Beyond
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
npm-pick-manifest
Advanced tools
Resolves a matching manifest from a package metadata document according to standard npm semver resolution rules.
The npm-pick-manifest package is designed to help users select a specific package version from a registry metadata object based on a desired version range. It is particularly useful for automating package selection tasks in package management and deployment scripts, ensuring that the most appropriate version of a package is selected according to semantic versioning rules.
Selecting a package version
This feature allows users to input a package metadata object and a version range. The function then returns the metadata for the version that best matches the range according to semantic versioning. This is particularly useful for resolving dependencies in package management.
const pickManifest = require('npm-pick-manifest');
const metadata = {
'name': 'some-package',
'versions': {
'1.0.0': {},
'1.2.0': {},
'2.0.0': {}
}
};
const range = '^1.0.0';
const selected = pickManifest(metadata, range);
console.log(selected.version); // Outputs: '1.2.0'
The semver package is a module for semantic versioning comparison. While npm-pick-manifest focuses on selecting a package version from a metadata object, semver provides a broader set of utilities for comparing versions, checking ranges, and more. It's more general-purpose compared to the specific use case addressed by npm-pick-manifest.
Pacote is a package fetching library that supports the entire package lifecycle, from resolving and fetching to extracting packages. While it includes functionality for selecting package versions similar to npm-pick-manifest, it is a more comprehensive tool that handles many aspects of package management beyond just version selection.
npm-pick-manifest
is a standalone
implementation of npm's semver range resolution algorithm.
$ npm install --save npm-pick-manifest
const pickManifest = require('npm-pick-manifest')
fetch('https://registry.npmjs.org/npm-pick-manifest').then(res => {
return res.json()
}).then(packument => {
return pickManifest(packument, '^1.0.0')
}) // get same manifest as npm would get if you `npm i npm-pick-manifest@^1.0.0`
The npm-pick-manifest team enthusiastically welcomes contributions and project participation! There's a bunch of things you can do if you want to contribute! The Contributor Guide has all the information you need for everything from reporting bugs to contributing entire new features. Please don't hesitate to jump in if you'd like to, or even ask us questions if something isn't clear.
> pickManifest(packument, selector, [opts]) -> manifest
Returns the manifest that matches selector
, or throws an error.
Packuments are anything returned by metadata URLs from the npm registry. That
is, they're objects with the following shape (only fields used by
npm-pick-manifest
included):
{
name: 'some-package',
'dist-tags': {
foo: '1.0.1'
},
versions: {
'1.0.0': { version: '1.0.0' },
'1.0.1': { version: '1.0.1' },
'1.0.2': { version: '1.0.2' },
'2.0.0': { version: '2.0.0' }
}
}
The algorithm will follow npm's algorithm for semver resolution, and only tag
,
range
, and version
selectors are supported.
The function will throw ETARGET
if there was no matching manifest, and
ENOVERSIONS
if the packument object has no valid versions in versions
.
If opts.defaultTag
is provided, it will be used instead of latest
. That is,
if that tag matches the selector, it will be used, even if a higher available
version matches the range.
FAQs
Resolves a matching manifest from a package metadata document according to standard npm semver resolution rules.
The npm package npm-pick-manifest receives a total of 7,176,909 weekly downloads. As such, npm-pick-manifest popularity was classified as popular.
We found that npm-pick-manifest demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
ESLint has added JSON and Markdown linting support with new officially-supported plugins, expanding its versatility beyond JavaScript.
Security News
Members Hub is conducting large-scale campaigns to artificially boost Discord server metrics, undermining community trust and platform integrity.
Security News
NIST has failed to meet its self-imposed deadline of clearing the NVD's backlog by the end of the fiscal year. Meanwhile, CVE's awaiting analysis have increased by 33% since June.