ARTIFACTORY: Virtual Repository Returns Older Package Version When Priority Resolution is Enabled

Summary

After upgrading Artifactory to version 7.120.0 or later, users may notice that resolving or installing an NPM package through a virtual repository returns an older stable version instead of the expected latest pre-release version.

This behavior is intentional and results from a change introduced to align Artifactory's NPM metadata merging with the official Semantic Versioning (SemVer) specification.

Problem

When executing an NPM install or resolving a package without explicitly specifying a version (for example, npm install <package>), Artifactory may return an older stable release even though a newer pre-release version exists in another member repository of the virtual repository.

Affected Versions

 - Artifactory 7.120.0 and later

Conditions Required to Reproduce

This behavior typically occurs when all of the following conditions are met:

• An NPM virtual repository contains multiple member (local) repositories.

• Priority Resolution is enabled on more than one member repository.

• The newest package version is a pre-release version (for example, milestone, alpha, beta, RC, or timestamp-based versions).

Another member repository contains an older stable version of the same package.

Cause

Beginning with Artifactory 7.120.0, the NPM package metadata merge logic for virtual repositories was updated to align with the official Semantic Versioning (SemVer) specification.

As part of this change, Artifactory uses a stable-first strategy when determining the latest dist-tag.

Under this behavior:

• Stable (non-pre-release) versions are always preferred when calculating the latest tag.

• Pre-release versions (such as alpha, beta, milestone, RC, or timestamp-based versions) are excluded from the latest selection, even if they were published more recently or have a higher version number.

• This behavior is by design and ensures compliance with SemVer recommendations.

  
  

For example: 

                        
Expected behavior
The latest dist-tag resolves to:

2.0.0-beta.1

Actual behavior
The latest dist-tag resolves to:

1.9.5

Resolution

If your development workflow requires the most recently published package to be considered the latest, regardless of whether it is a stable or pre-release version, you can configure Artifactory to determine the latest tag based on the package publish timestamp.

Step 1: Update the System Property
Open the following configuration file:

$JFROG_HOME/artifactory/var/etc/artifactory/artifactory.system.properties

Add the following property:

artifactory.npm.tag.tagLatestByPublish=true

If the property already exists, update its value to true.

Step 2: Restart Artifactory

After enabling artifactory.npm.tag.tagLatestByPublish=true, Artifactory will determine the latest dist-tag based on the most recently published package, rather than preferring the highest stable version according to SemVer.

As a result:

• Newer pre-release packages can become the latest version.

• Virtual repository resolution will return the most recently published package, regardless of whether it is a stable or pre-release release.