[BUG] wrong version used when publishing from a workspace

[Badisi]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Considering the following project structure and code:

my-project
├── dist
│   └── a
│       └── package.json # { "name: "a", "version": "1.0.0" }
├── projects
│   └── a
│       └── package.json # { "name: "a", "version": "0.0.0-semantically-released" }
├── package.json # { "name: "my-project", "workspaces": [ "projects/a" ] }
└── index.js

// index.js
const { exec } = require('node:child_process');
const cmd = exec(
    `npm publish ${process.cwd()}/dist/a --dry-run`,
    { cwd: `${process.cwd()}/projects/a` }
);
cmd.stdout.pipe(process.stdout, { end: false });
cmd.stderr.pipe(process.stderr, { end: false });

Running node index.js from ./my-project will result in:

 npm notice filename: a-0.0.0-semantically-released.tgz

instead of

 npm notice filename: a-1.0.0.tgz

The issue seems to be related to the workspaces attribute from the root package.json.

Because removing this attribute will produce the proper result.

Expected Behavior

I would expect that the package.json file used during the command npm publish {path} is the one located in the given path argument and not another one from somewhere else (being cwd or whatsoever).

Steps To Reproduce

1. git clone https://github.com/Badisi/issue-npm-publish-with-workspaces
2. npm install
3. npm run start

Environment

• platform: macOS Monterey 12.5.1 (21G83)
• node: v16.14.2
• npm: 8.19.2 (EDIT: still exists in 10.8.2, Node 18 & 20)

[Badisi]

This issue still exists in npm@9.2.0 and, as such, label should be updated to Release 9x.
Thanks

[Badisi]

This issue still exists in npm@9.6.0.

[Badisi]

This issue still exists in npm@9.8.0.

[bweigel]

I think I ran into this problem as well, however in a slightly different manner and before opening a new issue, I will add my finding to this one.

It seems that - within a workspace - npm publish <tarball> disregards that <tarball> argument and will fall back to what it finds in the workspace:

This showcases the behavior inside of a workspace. Notice the lines:

npm info found workspace root at ***/cdk-constructs/dist 
...
npm verb publish   '***/cdk-constructs/dist/packages/athena'

When I move the package outside of the workspace, I get the expected outcome, where the existing tarball is used:

I can force the expected behavior, if I pass --workspaces false to npm publish inside of the workspace, but this is just a hack for me right now.

@npm/cli-team do you have any comment on this issue?

---

Edit: before anyone asks, I have also tested this with Node v20.8.0 and NPM v10.1.0 and the issue still exists.

[Badisi]

I also confirm that this issue still exists in npm@10.2.0 (Node 18 & 20).

[Shakeskeyboarde]

Still an issue in npm@10.5.0 (Node 20).

[Badisi]

Still an issue in npm@10.8.2 (Node 20).

---

I also found (like @bweigel answer) that it's no really related to the version itself but to the <package-spec> argument that is not taken into account. See #7726 for more info.

[milaninfy]

Closing this, as newly reported issue #7726 is the similer if not duplicate. Keeping the newer one open for better visibility.