yarnpkg/yarn · error · MessageError

Can't add $0: invalid package version $1.

Error message

Can't add $0: invalid package version $1.

What it means

After findVersionInfo() fetches a manifest, Yarn runs semver.valid(info.version). If the version string isn't valid semver, it rejects the package because the entire dependency-range machinery depends on semver semantics.

Source

Thrown at src/package-request.js:241

    invariant(resolved, 'should have a resolved reference');

    this.reportResolvedRangeMatch(info, resolved);
    const ref = resolved._reference;
    invariant(ref, 'Resolved package info has no package reference');
    ref.addRequest(this);
    ref.addPattern(this.pattern, resolved);
    ref.addOptional(this.optional);
  }

  /**
   * TODO description
   */
  async find({fresh, frozen}: {fresh: boolean, frozen?: boolean}): Promise<void> {
    // find version info for this package pattern
    const info: Manifest = await this.findVersionInfo();

    if (!semver.valid(info.version)) {
      throw new MessageError(this.reporter.lang('invalidPackageVersion', info.name, info.version));
    }

    info.fresh = fresh;
    cleanDependencies(info, false, this.reporter, () => {
      // swallow warnings
    });

    // check if while we were resolving this dep we've already resolved one that satisfies
    // the same range
    const {range, name} = normalizePattern(this.pattern);
    const solvedRange = semver.validRange(range) ? info.version : range;
    const resolved: ?Manifest =
      !info.fresh || frozen
        ? this.resolver.getExactVersionMatch(name, solvedRange, info)
        : this.resolver.getHighestRangeVersionMatch(name, solvedRange, info);

    if (resolved) {
      this.resolver.reportPackageWithExistingVersion(this, info);

View on GitHub (pinned to c2dda503f3)

Solutions

1. Pin the dependency to a version range that excludes the offending version
2. Contact the package maintainer to publish a corrected semver version
3. Switch to a fork or npm alias that republishes with a valid version
4. Check the registry mirror for data corruption

Example fix

// before
"dep": "^1.0.0"
// after (pin away from the bad version)
"dep": "1.2.3"

import * as semver from 'semver';
if (!semver.valid(manifest.version)) {
  console.warn(`Skipping ${manifest.name}: version '${manifest.version}' is not valid semver`);
}

function hasValidVersion(manifest: {version?: string}): boolean {
  return typeof manifest.version === 'string' && semver.valid(manifest.version) !== null;
}

try {
  await request.find({fresh: true});
} catch (e) {
  if (e.message.includes('invalid package version')) {
    // exclude this version from the range or switch source
  }
}

When it happens

Trigger: A published package's manifest has a non-semver version (e.g., '1.0', 'latest', empty string, or a git ref). Validated in find() immediately after findVersionInfo().

Common situations: A dependency publishes with a malformed version field; git/tag-based exotic dependencies leaking a non-semver version; corrupted registry mirror serving bad metadata.

Related errors

• noName
• requiredVersionInRange
• invalidVersionArgument
• invalidVersion
• workspaceUnknownWorkspace

AI-assisted analysis of yarnpkg/yarn@c2dda503f3 (2026-08-13). Data as JSON: /api/errors/d19e07522559e087. Report an issue: GitHub.