1"use strict";(globalThis.webpackChunk_verdaccio_website=globalThis.webpackChunk_verdaccio_website||[]).push([[2384],{85940:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>i,toc:()=>l});const i=JSON.parse('{"id":"staged-publishing","title":"Staged publishing","description":"Staged publishing puts a review step in front of every publish. A version is","source":"@site/docs/staged-publishing.md","sourceDirName":".","slug":"/staged-publishing","permalink":"/docs/staged-publishing","draft":false,"unlisted":false,"editUrl":"https://github.com/verdaccio/website/edit/master/website/docs/staged-publishing.md","tags":[],"version":"current","lastUpdatedBy":"verdacciopack","lastUpdatedAt":1789720860000,"frontMatter":{"id":"staged-publishing","title":"Staged publishing"},"sidebar":"docs","previous":{"title":"Two-factor authentication","permalink":"/docs/two-factor-authentication"},"next":{"title":"Browser-based login","permalink":"/docs/web-login"}}');var a=s(8265),t=s(92233);const r={id:"staged-publishing",title:"Staged publishing"},o=void 0,d={},l=[{value:"Requirements",id:"requirements",level:2},{value:"Enabling it",id:"enabling",level:2},{value:"The flow",id:"flow",level:2},{value:"Staging a version",id:"staging",level:3},{value:"Reviewing what is waiting",id:"reviewing",level:3},{value:"Inspecting before approving",id:"inspecting",level:3},{value:"Approving",id:"approving",level:3},{value:"Rejecting",id:"rejecting",level:3},{value:"Who can do what",id:"permissions",level:2},{value:"The fallback",id:"permission-fallback",level:3},{value:"Making review a real gate",id:"four-eyes",level:3},{value:"The web interface",id:"web-ui",level:2},{value:"Interaction with two-factor authentication",id:"with-2fa",level:2},{value:"Notifications",id:"notifications",level:2},{value:"Where staged versions are stored",id:"storage",level:2},{value:"Limitations",id:"limitations",level:2},{value:"Troubleshooting",id:"troubleshooting",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(n.p,{children:"Staged publishing puts a review step in front of every publish. A version is\nuploaded to the registry but stays invisible to installs until a maintainer\nlooks at it and approves it. If nobody approves it, it never becomes a real\nversion."}),"\n",(0,a.jsxs)(n.p,{children:["It is driven entirely by ",(0,a.jsx)(n.code,{children:"npm stage"}),", so no extra tooling is needed on the\nclient side."]}),"\n",(0,a.jsxs)(n.admonition,{title:"Available from 7.x \u2014 test it on 9.x",type:"info",children:[(0,a.jsxs)(n.p,{children:["This feature ships in Verdaccio ",(0,a.jsx)(n.strong,{children:"7.x"})," and later. It is ",(0,a.jsx)(n.strong,{children:"not"})," available in\n",(0,a.jsx)(n.strong,{children:"6.x"}),", which does not receive new features."]}),(0,a.jsxs)(n.p,{children:["To try it today, use the ",(0,a.jsx)(n.strong,{children:"9.x experimental"})," line, which is where it lands\nfirst:"]}),(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"npm install -g verdaccio@next-9\n# or\ndocker pull verdaccio/verdaccio:nightly-master\n"})}),(0,a.jsxs)(n.p,{children:["Experimental releases are ",(0,a.jsx)(n.strong,{children:"not production-ready"})," and are meant for testing and\nearly feedback. Node.js ",(0,a.jsx)(n.code,{children:">= 24"})," is required."]})]}),"\n",(0,a.jsxs)(n.admonition,{type:"caution",children:[(0,a.jsxs)(n.p,{children:["This is an experimental feature behind the ",(0,a.jsx)(n.code,{children:"stage"})," flag. It is off by default,\nand the shape of the flag or its behaviour may change in a future release. See\n",(0,a.jsx)(n.a,{href:"configuration#experiments",children:"feature flags"}),"."]}),(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.strong,{children:"Not recommended for production yet."})," We would rather gather enough real usage\nfirst \u2014 see below on how to help with that."]})]}),"\n",(0,a.jsxs)(n.admonition,{title:"Feedback wanted",type:"info",children:[(0,a.jsxs)(n.p,{children:["This feature is experimental and shaped by what people report while using it.\nTell us whether the workflow fits how your team releases, what it does not cover\nfor your setup, and any rough edge or confusing error \u2014 in\n",(0,a.jsx)(n.a,{href:"https://github.com/verdaccio/verdaccio/discussions",children:"GitHub Discussions"}),", as an\nissue at ",(0,a.jsx)(n.a,{href:"https://github.com/verdaccio/verdaccio/issues",children:"verdaccio/verdaccio"}),",\nor on ",(0,a.jsx)(n.a,{href:"https://discord.gg/7qWJxBf",children:"Discord"}),"."]}),(0,a.jsxs)(n.p,{children:["Reports about what does ",(0,a.jsx)(n.strong,{children:"not"})," work are the most useful thing you can send\nwhile a feature is still experimental: they decide whether it graduates, changes\nshape, or gets dropped."]})]}),"\n",(0,a.jsx)(n.h2,{id:"requirements",children:"Requirements"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:[(0,a.jsx)(n.strong,{children:"npm 11.17 or newer"})," on the client. ",(0,a.jsx)(n.code,{children:"npm stage"})," does not exist in older\nversions, and there is no Yarn or pnpm equivalent yet."]}),"\n",(0,a.jsx)(n.li,{children:"A storage plugin, which is anything that works with Verdaccio today. Staged\nversions go through the same storage interface as everything else."}),"\n"]}),"\n",(0,a.jsx)(n.h2,{id:"enabling",children:"Enabling it"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"flags:\n stage: true\n"})}),"\n",(0,a.jsx)(n.p,{children:"Restart the registry afterwards: the configuration is read at startup."}),"\n",(0,a.jsxs)(n.p,{children:["With the flag off, the ",(0,a.jsx)(n.code,{children:"npm stage"})," commands answer ",(0,a.jsx)(n.code,{children:"404"})," and the registry behaves\nexactly as it always has."]}),"\n",(0,a.jsx)(n.h2,{id:"flow",children:"The flow"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{children:"npm stage publish the version is uploaded but not installable\nnpm stage list maintainers see what is waiting\nnpm stage view <id> inspect the metadata\nnpm stage download <id> inspect the actual tarball\n \u2502\n \u251c\u2500\u2500 npm stage approve <id> published for real, installable now\n \u2514\u2500\u2500 npm stage reject <id> record and tarball deleted, never existed\n"})}),"\n",(0,a.jsx)(n.h3,{id:"staging",children:"Staging a version"}),"\n",(0,a.jsxs)(n.p,{children:["From the package directory, exactly where you would run ",(0,a.jsx)(n.code,{children:"npm publish"}),":"]}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"npm stage publish\n"})}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{children:"npm notice Staging to http://localhost:4873/ with tag latest and default access\n+ [email protected] (staged
1with id 9efe8b0c-50b3-4183-ba3f-c46dfc784adb)\n"})}),"\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.code,{children:"--tag"})," works as usual, so ",(0,a.jsx)(n.code,{children:"npm stage publish --tag beta"})," stages the version to\nbe published under ",(0,a.jsx)(n.code,{children:"beta"})," once approved."]}),"\n",(0,a.jsxs)(n.p,{children:["At this point the version does ",(0,a.jsx)(n.strong,{children:"not"})," exist as far as installs are concerned:"]}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"npm view my-package\n# npm error 404 'my-package' is not in this registry\n"})}),"\n",(0,a.jsx)(n.h3,{id:"reviewing",children:"Reviewing what is waiting"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"npm stage list\n"})}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{children:"id: 9efe8b0c-50b3-4183-ba3f-c46dfc784adb\npackage name: my-package\nversion: 1.0.0\ntag: latest\ndate staged: 2026-08-29T14:21:45.777Z\nstaged by: alice (user)\nshasum: 54ec43441cacc23ad02ecec43ab46037b0e98aeb\naccess: public\n"})}),"\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.code,{children:"npm stage list <package-name>"})," narrows the list to one package, and\n",(0,a.jsx)(n.code,{children:"--json"})," gives you the raw records, which is what you want in a script:"]}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"npm stage list --json | jq -r '.[0].id'\n"})}),"\n",(0,a.jsxs)(n.p,{children:["The list only shows what you are allowed to see \u2014 see\n",(0,a.jsx)(n.a,{href:"#permissions",children:"who can do what"}),"."]}),"\n",(0,a.jsx)(n.h3,{id:"inspecting",children:"Inspecting before approving"}),"\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.code,{children:"npm stage view <id>"})," repeats the metadata for a single item. The interesting\none is:"]}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"npm stage download <id>\n"})}),"\n",(0,a.jsx)(n.p,{children:"This downloads the staged tarball and prints its contents, so you can check what\nis actually in the package before it becomes installable:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{children:"npm notice Tarball Contents\nnpm notice 24B index.js\nnpm notice 274B package.json\nnpm notice Tarball Details\nnpm notice name: my-package\nnpm notice shasum: 54ec43441cacc23ad02ecec43ab46037b0e98aeb\nmy-package-1.0.0-9efe8b0c-50b3-4183-ba3f-c46dfc784adb.tgz\n"})}),"\n",(0,a.jsxs)(n.p,{children:["The ",(0,a.jsx)(n.code,{children:"shasum"})," matches the one npm computed when it packed the tarball, so you can\nverify nothing changed in transit."]}),"\n",(0,a.jsx)(n.h3,{id:"approving",children:"Approving"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"npm stage approve 9efe8b0c-50b3-4183-ba3f-c46dfc784adb\n"})}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{children:"Staged package 9efe8b0c-50b3-4183-ba3f-c46dfc784adb approved and published successfully.\n"})}),"\n",(0,a.jsxs)(n.p,{children:["Approval replays the ordinary publish path, so everything that normally happens\non a publish happens here too: the version is checked against upstreams,\
1ndist-tags are merged, filter plugins run, and\n",(0,a.jsx)(n.a,{href:"notifications",children:"notifications"})," fire. The staged copy is removed once the version\nis really published."]}),"\n",(0,a.jsx)(n.p,{children:"The version is installable immediately afterwards."}),"\n",(0,a.jsx)(n.h3,{id:"rejecting",children:"Rejecting"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"npm stage reject 9efe8b0c-50b3-4183-ba3f-c46dfc784adb\n"})}),"\n",(0,a.jsxs)(n.p,{children:["The staged record and its tarball are deleted. The version never existed, so the\nsame ",(0,a.jsx)(n.code,{children:"name@version"})," can be staged again later."]}),"\n",(0,a.jsx)(n.h2,{id:"permissions",children:"Who can do what"}),"\n",(0,a.jsxs)(n.p,{children:["Staging has its own entry in ",(0,a.jsx)(n.a,{href:"packages",children:"package access"}),", alongside ",(0,a.jsx)(n.code,{children:"access"}),",\n",(0,a.jsx)(n.code,{children:"publish"})," and ",(0,a.jsx)(n.code,{children:"unpublish"}),":"]}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"packages:\n 'my-company-*':\n access: $authenticated\n stage: developers\n publish: release-managers\n"})}),"\n",(0,a.jsxs)(n.table,{children:[(0,a.jsx)(n.thead,{children:(0,a.jsxs)(n.tr,{children:[(0,a.jsx)(n.th,{children:"Action"}),(0,a.jsx)(n.th,{children:"Who"})]})}),(0,a.jsxs)(n.tbody,{children:[(0,a.jsxs)(n.tr,{children:[(0,a.jsx)(n.td,{children:(0,a.jsx)(n.code,{children:"npm stage publish"})}),(0,a.jsxs)(n.td,{children:["anyone allowed to ",(0,a.jsx)(n.code,{children:"stage"})," that package"]})]}),(0,a.jsxs)(n.tr,{children:[(0,a.jsx)(n.td,{children:(0,a.jsx)(n.code,{children:"npm stage list"})}),(0,a.jsxs)(n.td,{children:["items you staged, plus items on packages you may ",(0,a.jsx)(n.code,{children:"publish"})]})]}),(0,a.jsxs)(n.tr,{children:[(0,a.jsxs)(n.td,{children:[(0,a.jsx)(n.code,{children:"npm stage view"})," / ",(0,a.jsx)(n.code,{children:"download"})]}),(0,a.jsxs)(n.td,{children:["the person who staged it, or anyone who may ",(0,a.jsx)(n.code,{children:"publish"})," it"]})]}),(0,a.jsxs)(n.tr,{children:[(0,a.jsx)(n.td,{children:(0,a.jsx)(n.code,{children:"npm stage approve"})}),(0,a.jsxs)(n.td,{children:["anyone allowed to ",(0,a.jsx)(n.code,{children:"publish"})," that package"]})]}),(0,a.jsxs)(n.tr,{children:[(0,a.jsx)(n.td,{children:(0,a.jsx)(n.code,{children:"npm stage reject"})}),(0,a.jsxs)(n.td,{children:["the person who staged it, or anyone who may ",(0,a.jsx)(n.code,{children:"publish"})," it"]})]})]})]}),"\n",(0,a.jsxs)(n.p,{children:["Asking about a staged item you are not allowed to see answers ",(0,a.jsx)(n.code,{children:"404"}),", not ",(0,a.jsx)(n.code,{children:"403"}),".\nA ",(0,a.jsx)(n.code,{children:"403"})," would confirm the id exists to someone who has no business knowing that."]}),"\n",(0,a.jsx)(n.h3,{id:"permission-fallback",children:"The fallback"}),"\n",(0,a.jsxs)(n.p,{children:[(0,a.jsxs)(n.strong,{children:[(0,a.jsx)(n.code,{children:"stage"})," is optional."]})," When a package entry does not mention it, whoever may\n",(0,a.jsx)(n.code,{children:"publish"})," may also stage \u2014 exactly the behaviour before the permission existed \u2014\nso no existing configuration changes meaning. This mirrors how ",(0,a.jsx)(n.code,{children:"unpublish"}),"\nalready falls back to ",(0,a.jsx)(n.code,{children:"publish"}),"."]}),"\n",(0,a.jsx)(n.h3,{id:"four-eyes",children:"Making review a real gate"}),"\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.code,{children:"stage"})," only becomes interesting when it is granted to a group that does ",(0,a.jsx)(n.strong,{children:"not"}),"\nhave ",(0,a.jsx)(n.code,{children:"publish"}),":"]}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"packages:\n 'my-company-*':\n access: $authenticated\n stage: developers # may propose a release\n publish: release-managers # may actually make one\n"})}),"\n",(0,a.jsxs)(n.p,{children:["With that configuration a developer can run ",(0,a.jsx)(n.code,{children:"npm stage publish"})," but cannot\n",(0,a.jsx)(n.code,{children:"npm publish"}),", and cannot approve their own submission either. A release manager\nreviews the tarball and approves it. That is a genuine four-eyes workflow rather\nthan a convention people can bypass."]}),"\n",(0,a.jsxs)(n.p,{children:["Without the split \u2014 that is, with ",(0,a.jsx)(n.code,{children:"stage"})," unset \u2014 the same person can stage and\napprove their own version. Staging is then a convenience, not a control."]}),"\n",(0,a.jsxs)(n.p,{children:["Note that a developer can always ",(0,a.jsx)(n.strong,{children:"withdraw"})," their own submission with\n",(0,a.jsx)(n.code,{children:"npm stage reject"}),", even without publish rights. Retracting your own proposal is\nnot the same as rejecting somebody else's."]}),"\n",(0,a.jsx)(n.h2,{id:"web-ui",children:"The web interface"}),"\n",(0,a.jsxs)(n.p,{children:["When the flag is on, logged-in users get a ",(0,a.jsx)(n.strong,{children:"Staged packages"}
1)," entry in the\naccount menu, or you can go straight to ",(0,a.jsx)(n.code,{children:"/-/web/stage"}),"."]}),"\n",(0,a.jsx)(n.p,{children:"The list shows the same fields as the CLI, and each row has buttons to download\nthe tarball, approve or reject. Approving and rejecting both ask for\nconfirmation first, because neither can be undone from the UI. Clicking the\npackage name opens a detail view with the shasum and access level."}),"\n",(0,a.jsx)(n.p,{children:"You must be logged in: the page needs your session to call the registry."}),"\n",(0,a.jsx)(n.h2,{id:"with-2fa",children:"Interaction with two-factor authentication"}),"\n",(0,a.jsxs)(n.p,{children:["Staged publishing and ",(0,a.jsx)(n.a,{href:"two-factor-authentication",children:"two-factor authentication"})," are\nindependent \u2014 you can run either on its own. When both are on, they compose the\nway npmjs intends:"]}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:[(0,a.jsx)(n.code,{children:"npm stage publish"})," ",(0,a.jsx)(n.strong,{children:"never"})," asks for a one-time password. Being able to\npublish without proving presence is the point of staging: a CI job can stage a\nrelease and a human approves it later."]}),"\n",(0,a.jsxs)(n.li,{children:[(0,a.jsx)(n.code,{children:"npm stage approve"})," and ",(0,a.jsx)(n.code,{children:"npm stage reject"})," ",(0,a.jsx)(n.strong,{children:"do"})," ask for one, if the\nmaintainer has ",(0,a.jsx)(n.code,{children:"auth-and-writes"})," mode."]}),"\n"]}),"\n",(0,a.jsxs)(n.p,{children:["That combination is the reason ",(0,a.jsx)(n.code,{children:"npm stage"})," exists on npmjs, and it is what lets\nan automated pipeline prepare a release without holding a second factor."]}),"\n",(0,a.jsx)(n.h2,{id:"notifications",children:"Notifications"}),"\n",(0,a.jsxs)(n.p,{children:["If you have ",(0,a.jsx)(n.a,{href:"notifications",children:"notifications"})," configured, staging fires one with\n",(0,a.jsx)(n.code,{children:"publishType: stage"}),", and rejecting fires ",(0,a.jsx)(n.code,{children:"publishType: unstage"}),". Approving fires\n",(0,a.jsx)(n.code,{children:"publish"}),", like any other publish."]}),"\n",(0,a.jsxs)(n.p,{children:["That is what makes the review step workable in practice \u2014 otherwise a staged\nversion waits until somebody happens to run ",(0,a.jsx)(n.code,{children:"npm stage list"}),":"]}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:'notify:\n method: POST\n endpoint: https://hooks.example.org/reviews\n content: \'{"type":"{{ publishType }}","package":"{{ publishedPackage }}","by":"{{ publisher.name }}"}\'\n'})}),"\n",(0,a.jsxs)(n.p,{children:["See ",(0,a.jsx)(n.a,{href:"notifications#publish-type",children:"publish type"})," for the full list of values."]}),"\n",(0,a.jsx)(n.h2,{id:"storage",children:"Where staged versions are stored"}),"\n",(0,a.jsx)(n.p,{children:"Staged items live under a reserved namespace in whatever storage backend you\nalready use:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{children:"<storage>/.stage/package.json index of everything staged\n<storage>/.stage/<uuid>/package.json the staged record and its metadata\n<storage>/.stage/<uuid>/<name>-<v>.tgz the staged tarball\n"})}),"\n",(0,a.jsxs)(n.p,{children:["The namespace is deliberately never registered in the storage plugin's package\ndatabase, so staged ver
1sions never show up in search, in ",(0,a.jsx)(n.code,{children:"/-/all"}),", or on the web\nUI home page."]}),"\n",(0,a.jsx)(n.h2,{id:"limitations",children:"Limitations"}),"\n",(0,a.jsx)(n.p,{children:"Worth knowing before you turn this on:"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:[(0,a.jsx)(n.strong,{children:"Nothing expires."})," A staged version that nobody approves or rejects stays on\ndisk forever. There is no automatic cleanup yet, so keep an eye on\n",(0,a.jsx)(n.code,{children:"<storage>/.stage"})," if staging is used heavily."]}),"\n",(0,a.jsxs)(n.li,{children:[(0,a.jsx)(n.strong,{children:"One Verdaccio process."})," The index of staged items is kept consistent within\na process. Several Verdaccio instances sharing one storage backend are not\nsupported for this feature."]}),"\n",(0,a.jsxs)(n.li,{children:[(0,a.jsx)(n.strong,{children:"Approval holds the tarball in memory."})," The tarball is read back in full to\nbe republished, so approving a very large package uses memory proportional to\nits size."]}),"\n",(0,a.jsxs)(n.li,{children:[(0,a.jsx)(n.strong,{children:"Staging and approving are the same permission."})," See\n",(0,a.jsx)(n.a,{href:"#permissions",children:"who can do what"}),"."]}),"\n",(0,a.jsxs)(n.li,{children:[(0,a.jsx)(n.strong,{children:"npm only."})," Yarn and pnpm have no equivalent command."]}),"\n"]}),"\n",(0,a.jsx)(n.h2,{id:"troubleshooting",children:"Troubleshooting"}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsx)(n.strong,{children:(0,a.jsx)(n.code,{children:"404 Not Found - POST http://localhost:4873/-/stage/package/..."})})}),"\n",(0,a.jsx)(n.p,{children:"The flag is off, or the server was not restarted after enabling it. Check that\nthe running server is using the configuration file you edited."}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsxs)(n.strong,{children:[(0,a.jsx)(n.code,{children:"npm error code E404"})," on ",(0,a.jsx)(n.code,{children:"npm stage list"})]})}),"\n",(0,a.jsx)(n.p,{children:"Same cause. With the flag off none of the routes are registered."}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsxs)(n.strong,{children:["A version was approved but ",(0,a.jsx)(n.code,{children:"npm install"})," cannot find it"]})}),"\n",(0,a.jsxs)(n.p,{children:["Check whether you have ",(0,a.jsx)(n.code,{children:"min-release-age"})," set in your ",(0,a.jsx)(n.code,{children:".npmrc"}),". npm refuses to\ninstall packages published more recently than that, which looks like the\nregistry losing the version:"]}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"npm install my-package --min-release-age=0\n"})}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsxs)(n.strong,{children:[(0,a.jsx)(n.code,{children:"409 Conflict"})," when staging"]})}),"\n",(0,a.jsxs)(n.p,{children:["Either that exact ",(0,a.jsx)(n.code,{children:"name@version"})," is already published, or it is already staged.\n",(0,a.jsx)(n.code,{children:"npm stage list <package>"})," shows the latter."]}),"\n",(0,a.jsx)(n.p,{children:(0,a.jsxs)(n.strong,{children:[(0,a.jsx)(n.code,{children:"409 Conflict"})," when approving"]})}),"\n",(0,a.jsx)(n.p,{children:"The version was published by some other route while it sat in the queue. The\nstaged item is kept on purpose so you can still inspect it and decide; reject it\nif the published version is the one you wanted."})]})}function h(e={}){const{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,a.jsx)(n,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},92233:(e,n,s)=>{s.d(n,{R:()=>r,x:()=>o});var i=s(70141);const a={},t=i.createContext(a);function r(e){const n=i.useContext(t);return i.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:r(e.components),i.createElement(t.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.