{"record":{"id":"d19e07522559e087","repo":"yarnpkg/yarn","slug":"can-t-add-0-invalid-package-version-1","errorCode":null,"errorMessage":"Can't add $0: invalid package version $1.","messagePattern":"Can't add \\$0: invalid package version \\$1\\.","errorType":"validation","errorClass":"MessageError","httpStatus":null,"severity":"error","filePath":"src/package-request.js","lineNumber":241,"sourceCode":"    invariant(resolved, 'should have a resolved reference');\n\n    this.reportResolvedRangeMatch(info, resolved);\n    const ref = resolved._reference;\n    invariant(ref, 'Resolved package info has no package reference');\n    ref.addRequest(this);\n    ref.addPattern(this.pattern, resolved);\n    ref.addOptional(this.optional);\n  }\n\n  /**\n   * TODO description\n   */\n  async find({fresh, frozen}: {fresh: boolean, frozen?: boolean}): Promise<void> {\n    // find version info for this package pattern\n    const info: Manifest = await this.findVersionInfo();\n\n    if (!semver.valid(info.version)) {\n      throw new MessageError(this.reporter.lang('invalidPackageVersion', info.name, info.version));\n    }\n\n    info.fresh = fresh;\n    cleanDependencies(info, false, this.reporter, () => {\n      // swallow warnings\n    });\n\n    // check if while we were resolving this dep we've already resolved one that satisfies\n    // the same range\n    const {range, name} = normalizePattern(this.pattern);\n    const solvedRange = semver.validRange(range) ? info.version : range;\n    const resolved: ?Manifest =\n      !info.fresh || frozen\n        ? this.resolver.getExactVersionMatch(name, solvedRange, info)\n        : this.resolver.getHighestRangeVersionMatch(name, solvedRange, info);\n\n    if (resolved) {\n      this.resolver.reportPackageWithExistingVersion(this, info);","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/yarnpkg/yarn/blob/c2dda503f3759b5be5f0e24ecd9cf5c97a540147/src/package-request.js#L223-L259","documentation":"After findVersionInfo() fetches a manifest, Yarn runs semver.valid(info.version). If the version string isn't valid semver, it rejects the package because the entire dependency-range machinery depends on semver semantics.","triggerScenarios":"A published package's manifest has a non-semver version (e.g., '1.0', 'latest', empty string, or a git ref). Validated in find() immediately after findVersionInfo().","commonSituations":"A dependency publishes with a malformed version field; git/tag-based exotic dependencies leaking a non-semver version; corrupted registry mirror serving bad metadata.","solutions":["Pin the dependency to a version range that excludes the offending version","Contact the package maintainer to publish a corrected semver version","Switch to a fork or npm alias that republishes with a valid version","Check the registry mirror for data corruption"],"exampleFix":"// before\n\"dep\": \"^1.0.0\"\n// after (pin away from the bad version)\n\"dep\": \"1.2.3\"","handlingStrategy":"validation","validationCode":"import * as semver from 'semver';\nif (!semver.valid(manifest.version)) {\n  console.warn(`Skipping ${manifest.name}: version '${manifest.version}' is not valid semver`);\n}","typeGuard":"function hasValidVersion(manifest: {version?: string}): boolean {\n  return typeof manifest.version === 'string' && semver.valid(manifest.version) !== null;\n}","tryCatchPattern":"try {\n  await request.find({fresh: true});\n} catch (e) {\n  if (e.message.includes('invalid package version')) {\n    // exclude this version from the range or switch source\n  }\n}","preventionTips":["Validate manifests with semver.valid before depending on them","Pin dependencies to specific known-good versions in production","Monitor dependency health for malformed publishes"],"tags":["semver","manifest","validation"],"backgroundTag":null,"analyzedSha":"c2dda503f3759b5be5f0e24ecd9cf5c97a540147","analyzedAt":"2026-08-13T04:17:06.305Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}