[PR #224] [MERGED] fix(upgrade): prevent version downgrades #1877

New issue

Closed

opened 2026-10-16 21:12:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/224
Author: @N0zoM1z0
Created: 7/14/2026
Status: ✅ Merged
Merged: 7/14/2026
Merged by: @morluto

Base: main ← Head: agent/upgrade-no-downgrade

📝 Commits (1)

1d1d234 fix(upgrade): prevent version downgrades

📊 Changes

4 files changed (+76 additions, -8 deletions)

View changed files

📝 package-lock.json (+9 -1)
📝 package.json (+2 -0)
📝 src/application/Upgrade.ts (+18 -4)
📝 tests/upgrade.test.ts (+47 -3)

📄 Description

Summary

compare installed and registry versions with node-semver before invoking npm
upgrade only when the registry version is valid and strictly newer
treat equal, older, and prerelease ordering correctly
fail closed without mutation when registry/version metadata is unavailable or invalid
declare semver and its TypeScript types explicitly

The root cause was using string inequality as the upgrade decision, so 2.0.0 installed with registry 1.9.0 still ran npm install @latest and downgraded the package.

Context7’s current npm documentation confirms package versions follow node-semver parsing and ordering.

Verification

Doctor/upgrade focused suites: 27/27 passed
npm run typecheck
touched-file oxlint
touched-file Prettier check

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/224 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/14/2026 **Status:** ✅ Merged **Merged:** 7/14/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `agent/upgrade-no-downgrade` --- ### 📝 Commits (1) - [`1d1d234`](https://github.com/morluto/rea/commit/1d1d234eedd3b73108cd2fb41878680ca107bb7c) fix(upgrade): prevent version downgrades ### 📊 Changes **4 files changed** (+76 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+9 -1) 📝 `package.json` (+2 -0) 📝 `src/application/Upgrade.ts` (+18 -4) 📝 `tests/upgrade.test.ts` (+47 -3) </details> ### 📄 Description ## Summary - compare installed and registry versions with node-semver before invoking npm - upgrade only when the registry version is valid and strictly newer - treat equal, older, and prerelease ordering correctly - fail closed without mutation when registry/version metadata is unavailable or invalid - declare semver and its TypeScript types explicitly The root cause was using string inequality as the upgrade decision, so `2.0.0` installed with registry `1.9.0` still ran `npm install @latest` and downgraded the package. Context7’s current npm documentation confirms package versions follow node-semver parsing and ordering. ## Verification - Doctor/upgrade focused suites: 27/27 passed - `npm run typecheck` - touched-file oxlint - touched-file Prettier check --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:05 +00:00