[BUG] outdated shows unreachable packages which were released later chronologically

[dkarlovi]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I install package ^2.2.0, it installs 2.2.1
I run outdated
It shows 1.2.0 as latest

Expected Behavior

I install package ^2.2.0, it installs 2.2.1
I run outdated
It doesn't shows 1.2.0 as latest since my requirement prevents it being installed, it doesn't matter it's chronologically latest

Steps To Reproduce

$ npm install -S @opensearch-project/opensearch@^2.2.0

added 7 packages in 525ms
$ npm outdated
Package                         Current  Wanted  Latest  Location                                     Depended by
@opensearch-project/opensearch    2.2.1   2.2.1   1.2.0  node_modules/@opensearch-project/opensearch  npm-test

Environment

• npm: 9.5.1
• Node.js: v18.16.0
• OS Name: Fedora Linux
• System Model Name: 38
• npm config:

; "global" config from /etc/npmrc

prefix = "/usr/local" 
python = "/usr/bin/python3" 

; "user" config from /home/dkarlovi/.npmrc

//registry.npmjs.org/:_authToken = (protected) 

; node bin location = /usr/bin/node-18
; node version = v18.16.0
; npm local prefix = /home/dkarlovi/Development/RandD/npm-test
; npm version = 9.5.1
; cwd = /home/dkarlovi/Development/RandD/npm-test
; HOME = /home/dkarlovi
; Run `npm config ls -l` to show all defaults.

[ljharb]

Chronology is irrelevant; latest is a dist-tag that can be pointed to any version.

[dkarlovi]

@ljharb I don't understand what you meant, I agree chronology is irrelevant and npm outdated should be empty here, why is it showing me anything at all? This makes it seem like my package is outdated while it isn't.

[ljharb]

I can see that argument. Currently, if v1 is marked "latest", then v2 is likely unstable in some way, so I think it makes sense to warn you.

In this case, it's a mistake by the maintainers: see opensearch-project/opensearch-js#521.

[dkarlovi]

Currently, if v1 is marked "latest", then v2 is likely unstable in some way, so I think it makes sense to warn you.

In LTS scenarios you'll often see multiple major versions being maintained and released concurrently. Just because they've happened to have released 2.x, then 1.x instead of the other way around shouldn't influence the output here IMO, especially since with my constraints the version suggested is not even reachable.