badges/shields · error · NotFound

no released version found

Error message

no released version found

What it means

The Packagist base service collects version strings from the packagist metadata and, if none survive filtering (no entries with a string `version` field), throws NotFound with this message. It represents a package that exists on Packagist but has no usable released versions listed.

Source

Thrown at services/packagist/packagist-base.js:161

   * Find the object representation of the latest release.
   *
   * @param {object[]} versions An array of object representing a version.
   * @param {boolean} includePrereleases Includes pre-release semver for the search.
   *
   * @returns {object} The object of the latest version.
   * @throws {NotFound} Thrown if there is no item from the version array.
   */
  findLatestRelease(versions, includePrereleases = false) {
    // Find the latest version string, if not found, throw NotFound.
    const versionStrings = versions
      .filter(
        version =>
          typeof version.version === 'string' ||
          version.version instanceof String,
      )
      .map(version => version.version)
    if (versionStrings.length < 1) {
      throw new NotFound({ prettyMessage: 'no released version found' })
    }

    let release = latest(versionStrings)
    if (!includePrereleases) {
      release = latest(versionStrings.filter(isStable)) || release
    }
    return versions.filter(version => version.version === release)[0]
  }
}

const description = `
<a href="https://packagist.org/">Packagist</a> is a registry for PHP packages which can be installed with Composer.
`

const customServerDocumentationFragment = `
Note that only network-accessible packagist.org and other self-hosted Packagist instances are supported.
`

View on GitHub (pinned to 766fd8bc89)

Solutions

  1. Confirm the package has at least one tagged release on packagist.org; if you own it, tag a release (e.g. v1.0.0) and push it.
  2. Verify the vendor/package name in the badge URL points at the intended package.
  3. If the package is abandoned, remove the badge or point it at a maintained fork.

Example fix

// before
composer require --dev vendor/pkg  (never tagged)
// after
git tag v1.0.0 && git push origin v1.0.0  (then re-check the badge)
Defensive patterns

Strategy: validation

Validate before calling

// Ensure the package has tagged releases before using a version badge
const meta = await fetch(`https://repo.packagist.org/p2/${vendor}/${pkg}.json`).then(r => r.json())
const versions = (meta.packages?.[`${vendor}/${pkg}`] || []).filter(v => typeof v.version === 'string')
if (versions.length < 1) throw new Error('Package has no tagged releases')

Type guard

function hasReleases(meta, name) {
  const list = meta && meta.packages && meta.packages[name]
  return Array.isArray(list) &&
    list.some(v => typeof v.version === 'string' || v.version instanceof String)
}

Try / catch

try {
  const badge = await getPackagistVersion(vendor, pkg)
} catch (e) {
  if (e.message === 'no released version found') {
    // package exists but untagged: omit badge until a release is tagged
  } else { throw e }
}

Prevention

When it happens

Trigger: Requesting a Packagist version/dependency badge for a package whose metadata `versions` object is empty or contains only entries lacking string version fields (length < 1 after mapping).

Common situations: Newly registered packages with no tagged releases (only dev branches), abandoned packages whose versions were purged, or branch-only/abandoned packages where packagist lists no version entries.

Related errors

AI-assisted analysis of badges/shields@766fd8bc89 (2026-08-30). Data as JSON: /api/errors/4f8dead326e4a246. Report an issue: GitHub.