{"record":{"id":"7386712b69f1945e","repo":"parcel-bundler/parcel","slug":"name-version-only-npm-semver-dependencies-a","errorCode":null,"errorMessage":"${name}@${version}: only npm semver dependencies are currently supported.","messagePattern":"(.+?)@(.+?): only npm semver dependencies are currently supported\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/dev/repl/SimplePackageInstaller/index.js","lineNumber":91,"sourceCode":"      modified: string,\n      'dist-tags': {|[string]: string|},\n      versions: {|[string]: ResolveCacheEntry|},\n    |} = await res.json();\n\n    let resolvedVersion;\n    if (version in data['dist-tags']) {\n      resolvedVersion = data['dist-tags'][version];\n    } else if (semver.validRange(version)) {\n      // $FlowFixMe\n      resolvedVersion = (semver.maxSatisfying(\n        Object.keys(data.versions),\n        version,\n      ): string);\n      if (!resolvedVersion) {\n        throw new Error(`npmResolve failed: resolving ${name}@${version}`);\n      }\n    } else {\n      throw new Error(\n        `${name}@${version}: only npm semver dependencies are currently supported.`,\n      );\n    }\n    this.cache.resolve.set(\n      `${name}@${version}`,\n      data.versions[resolvedVersion],\n    );\n    return data.versions[resolvedVersion];\n  }\n\n  async _npmFetch(tarball: string): Promise<Map<string, Uint8Array>> {\n    const cacheEntry = this.cache.fetch.get(tarball);\n    if (cacheEntry) {\n      return cacheEntry;\n    }\n\n    const res = await fetch(tarball);\n    if (!res.ok) {","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/parcel-bundler/parcel/blob/59484858a1a0bcbb71f74088956bb437a2db6505/packages/dev/repl/SimplePackageInstaller/index.js#L73-L109","documentation":"Thrown by `SimplePackageInstaller._npmResolve` when the version string is neither a key in the registry's `dist-tags` nor a valid npm semver range. The REPL installer intentionally rejects non-npm specifiers because it only knows how to fetch from the public npm registry.","triggerScenarios":"Specifier uses a git URL (`git+https://...`), GitHub shorthand (`user/repo`), local file (`file:../pkg`), link (`link:../pkg`), or an `npm:` alias; specifier is malformed and fails `semver.validRange`.","commonSituations":"Copying a dependency from a monorepo `package.json` that uses `workspace:*` or `link:`; pasting a git URL; typos in a version string that make it non-semver.","solutions":["Replace the specifier with a concrete version or semver range that exists on the public registry.","For aliased packages (`npm:foo@^1.2.3`), unwrap to the real package name and version.","For workspace/link deps, the REPL cannot install them — substitute the published npm version.","Validate the string with `semver.validRange(spec)` before submitting."],"exampleFix":"// before\ninstaller._npmResolve('mylib', 'file:../mylib')\n// after\ninstaller._npmResolve('mylib', '^1.2.0')","handlingStrategy":"validation","validationCode":"const semver = require('semver');\nfunction isReplSupportedSpec(version, distTags = ['latest']) {\n  return distTags.includes(version) || !!semver.validRange(version);\n}","typeGuard":"function isNpmSemverSpec(spec) {\n  return typeof spec === 'string' && !/^(file|link|git|workspace|npm):/.test(spec) && !!semver.validRange(spec);\n}","tryCatchPattern":null,"preventionTips":["Reject git/file/link/workspace specs before submitting to the REPL installer.","Validate with `semver.validRange` on user input.","Unwrap `npm:` aliases client-side."],"tags":["semver","npm","dependency-resolution","repl"],"backgroundTag":null,"analyzedSha":"59484858a1a0bcbb71f74088956bb437a2db6505","analyzedAt":"2026-08-13T04:06:35.925Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}