publishing npm packages with "+" in the version remove the "+" and any characters after

SENSITIVE DATA HAS BEEN REMOVED FROM THIS TICKET ACCORDING TO JFROG'S INTERNAL POLICY.

 

Steps to reproduce:

-) publish package to npm.js with version 4.0.0+0.0.1. See that the version publish is just 4.0.0 (+0.0.1 is stripped off)

npm publish

...

npm notice

+ matthewwtest@4.0.0

See https://www.npmjs.com/package/matthewwtest

-) publish the same package to Artifactory by adding to the package.json:

"publishConfig":

{     "registry": "RESTRICTED_URL"   }

,

See that the +0.0.1 is kept (When you check the metadata for the package at http://localhost:8081/artifactory/api/npm/npm-local/matthewwtest):

"versions" : { "4.0.0+0.0.1" :

-) installing the version from Artifactory will fail because the npm client will strip the +0.0.1.

npm install matthewwtest@3.0.0+0.0.1 -dd

npm info it worked if it ends with ok

npm verb cli [ '/usr/local/Cellar/node/10.11.0/bin/node',

npm verb cli   '/usr/local/bin/npm',

npm verb cli   'install',

npm verb cli   'matthewwtest@3.0.0+0.0.1',

npm verb cli   '-dd' ]

npm info using npm@6.4.1

npm info using node@v10.11.0

npm verb npm-session aa0f3ac7b7cd080e

npm http fetch GET 200 http://localhost:8081/artifactory/api/npm/npm-local/matthewwtest 132ms

npm http fetch GET 304 http://localhost:8081/artifactory/api/npm/npm-local/matthewwtest 84ms

...

npm verb stack matthewwtest: No matching version found for matthewwtest@3.0.0

-when deploying to artifactory with a version with a "", the "" and any characters after should be removed, and the metadata in Artifactory should reflect this.