n8n-io/n8n · error · Error

No version found matching ${version}

Error message

No version found matching ${version}

What it means

Thrown during version resolution when the requested version is a valid semver RANGE (e.g. '^1.2.0', '~2.0', '>=3 <4') but semver.maxSatisfying(versions, version) returns null - none of the published versions in the registry metadata satisfy the range. Distinct from a 404 (the package exists, just no matching version).

Source

Thrown at packages/@n8n/scan-community-package/scanner/scanner.mjs:357

			error,
		};
	}
};

export const analyzePackageByName = async (packageName, version) => {
	try {
		let exactVersion = version;
		let packageMetadata;

		// If version is a range, get the latest matching version
		if (version && semver.validRange(version) && !semver.valid(version)) {
			const { data } = await axios.get(`${registry}/${packageName}`);
			packageMetadata = data;
			const versions = Object.keys(data.versions);
			exactVersion = semver.maxSatisfying(versions, version);

			if (!exactVersion) {
				throw new Error(`No version found matching ${version}`);
			}
		}

		// If no version specified, get the latest
		if (!exactVersion) {
			const { data } = await axios.get(`${registry}/${packageName}`);
			packageMetadata = data;
			exactVersion = data['dist-tags'].latest;
		}

		packageMetadata ??= (await axios.get(`${registry}/${packageName}`)).data;
		exactVersion = packageMetadata['dist-tags']?.[exactVersion] ?? exactVersion;
		const label = `${packageName}@${exactVersion}`;

		stdout.write(`Checking provenance for ${label}...`);
		const provenanceResult = checkPackageProvenance(packageMetadata, exactVersion);
		if (stdout.TTY) {
			stdout.clearLine(0);

View on GitHub (pinned to 5ac6606e81)

Solutions

1. List published versions: `npm view ${packageName} versions --json` and pick a concrete version that exists.
2. If you need 'latest', omit the version entirely so the scanner uses dist-tags.latest.
3. Loosen or correct the range (e.g. '^1.0.0' instead of '^1.2.3' when 1.2.3 was unpublished).
4. For pre-release ranges, ensure the range explicitly includes pre-release tags (semver only matches pre-releases when the range has a pre-release in the same [major,minor,patch] tuple).

Example fix

// before
const { exactVersion } = await resolveVersion(registry, packageName, '^5.0.0'); // throws if no 5.x

// after - probe published versions first, fall back to latest
const { data } = await axios.get(`${registry}/${packageName}`);
const exactVersion = semver.maxSatisfying(Object.keys(data.versions), '^5.0.0')
  ?? data['dist-tags'].latest;
if (!exactVersion) throw new Error(`No version found matching ^5.0.0`);

import semver from 'semver';
import axios from 'axios';

async function pickVersion(registry: string, packageName: string, requested: string | null): Promise<string> {
  const { data } = await axios.get(`${registry}/${packageName}`);
  const versions = Object.keys(data.versions);
  if (!requested) return data['dist-tags'].latest;
  if (semver.valid(requested)) return requested;
  const match = semver.maxSatisfying(versions, requested);
  if (!match) throw new Error(`Range ${requested} matches none of ${versions.length} published versions`);
  return match;
}

function isConcreteVersion(v: string): boolean {
  return semver.valid(v) !== null;
}

When it happens

Trigger: resolveVersion is called with a range; the registry metadata is fetched; Object.keys(data.versions) yields the published versions; semver.maxSatisfying returns null. Common when the range targets a version that was unpublished, a pre-release range with no matching pre-releases, or a range wider than any published major.

Common situations: Scanning '@scope/pkg@^5' when only 4.x is published; requesting a pre-release range ('>1.0.0-alpha') against a package with no pre-releases; a yanked version left the range unsatisfiable; tag/branch typo that resolves to a nonsensical range.

Related errors

• npm pack failed: ${npmResult.stderr?.toString()}
• Tarball not found
• Provided message is not a valid Langchain message: ${JSON.st
• Path traversal detected, refusing to join paths: ${parentPat
• Invalid package specification

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/d4111837b328803b. Report an issue: GitHub.