Skip to content

fix(arborist): reject uninstall args that carry a version - #9930

Merged
reggi merged 1 commit into
release/v11from
backport/v11/9881
Aug 28, 2026
Merged

fix(arborist): reject uninstall args that carry a version#9930
reggi merged 1 commit into
release/v11from
backport/v11/9881

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Backport of #9881 to release/v11.

## What / Why

`npm uninstall vite@8.2.1` neither removes the package nor complains
about the argument. The spec goes straight through to Arborist as an
`rm` entry, nothing in the tree is named `vite@8.2.1`, so the reify
finishes with "up to date" and `npm ls` still shows `vite`.

`npm update` already validates its own argument list and throws
`EUPDATEARGS` for anything that is not a bare package name. This applies
the same rule to `rm`, so a version, tag or range now fails with
`ERMARGS` and the message names the command to run instead.

## Testing

New case in `workspaces/arborist/test/arborist/build-ideal-tree.js`,
next to the existing rm test and mirroring the update one. It covers an
exact version, a tag, ranges, a scoped name carrying a version, and a
filesystem path, where the suggestion falls back to `<pkg>` because
there is no name to print. It fails without the change.

## References

Fixes #9880

(cherry picked from commit da50c34)
@reggi
reggi merged commit 70317da into release/v11 Aug 28, 2026
50 checks passed
@reggi
reggi deleted the backport/v11/9881 branch August 28, 2026 18:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants