modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: v1 dist-tag must be v1-latest — npm rejects v1 (#1829)

Browse source 
#1828 pinned v1 publishes to `--tag v1`, following the runbook (#1804 §1). That
tag name is not legal: npm rejects any dist-tag that parses as a SemVer range,
and `v1` parses as `1.x`.

    npm error Tag name must not be a valid SemVer range: v1

Found while running the companion `npm dist-tag add` step, which failed the
same way. So the merged flag would not have "published to the wrong tag" — the
next v1 security release would have failed to publish at all, and only at
release time.

`v1-latest` is accepted (verified against semver.validRange, along with
`legacy`, which was the other candidate). The workflow comment now records both
failure modes so neither the flag nor the specific tag name gets "cleaned up"
later.


Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-07-27 21:52:57 -04:00 • committed by GitHub
commit 47f92841bc
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 10 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
.github/workflows/main.yml vendored
View file

@ -65,10 +65,15 @@ jobs:
- name: Ensure npm CLI supports OIDC trusted publishing
run: npm install -g npm@^11.5.1
# `publish-all` pins `--tag v1` on all four packages. Do NOT remove it:
# without an explicit tag npm assigns `latest`, so a v1 security release
# would drag `latest` back from v2 and every `npx
# @modelcontextprotocol/inspector` would silently get deprecated v1.
# `publish-all` pins `--tag v1-latest` on all four packages.
#
# Do NOT drop the flag: without an explicit tag npm assigns `latest`, so a
# v1 security release would drag `latest` back from v2 and every
# `npx @modelcontextprotocol/inspector` would silently get deprecated v1.
#
# Do NOT "simplify" the tag to `v1`: npm rejects any dist-tag that parses
# as a SemVer range, and `v1` does (`npm error Tag name must not be a
# valid SemVer range: v1`). That would fail the publish outright.
- run: npm run publish-all
env:
NPM_CONFIG_PROVENANCE: "true"

2
package.json
View file

@ -47,7 +47,7 @@
"prettier-check": "prettier --check .",
"lint": "prettier --check . && cd client && npm run lint",
"prepare": "husky && npm run build",
"publish-all": "npm publish --workspaces --access public --tag v1 && npm publish --access public --tag v1",
"publish-all": "npm publish --workspaces --access public --tag v1-latest && npm publish --access public --tag v1-latest",
"update-version": "node scripts/update-version.js",
"check-version": "node scripts/check-version-consistency.js"
},