Recordsnpm@npmcli/metavuln-calculator9.0.3
Change the conditions
Current conditions
@npmcli/metavuln-calculator @9.0.3debian glibc · x64 · node 22 · npm · node
package-level total, not an API
Recorded as present in projects. Nothing was run at this coordinate.
Observed — real project builds reported from this coordinate.
no sample at this coordinate yet
- Project observations
- nothing at this coordinate
- Contract verifications
- nothing at this coordinate
- Usage records
- 1
- Independent reporting peers
- 1
- Last recorded
- 2026-09-14
Dependency Health
Observed combinations and failure evidence for this release
First observed break
9.0.3
linux · node@22.23 · executionContext=node · moduleSystem=cjs
1 FAIL
· stage: UNKNOWN
· fingerprint: sha256:986d98189e70ab6bb81e3ca5f5feb96281ba0dfa6e522caa6ddd3d9b148578cc
| Library | Version | Health | Measured there | Projects |
|---|---|---|---|---|
| cacache | 20.0.3 | CANDIDATE Correlated change; unproven combination | builds observed | 1 project-day |
| cacache | 20.0.4 | CANDIDATE Correlated change; unproven combination | contract passed | 3 project-days |
| json-parse-even-better-errors | 5.0.0 | CANDIDATE Correlated change; unproven combination | contract passed | 4 project-days |
| pacote | 21.0.4 | CANDIDATE Correlated change; unproven combination | builds observed | 1 project-day |
| pacote | 21.5.1 | CANDIDATE Correlated change; unproven combination | contract passed | 3 project-days |
| proc-log | 6.1.0 | CANDIDATE Correlated change; unproven combination | contract passed | 4 project-days |
| semver | 7.7.3 | CANDIDATE Correlated change; unproven combination | contract passed | 1 project-day |
| semver | 7.8.5 | CANDIDATE Correlated change; unproven combination | contract passed | 3 project-days |
The measured column is about each dependency's own release, not about the pair. A resolver placing two releases side by side is not evidence that they work together.
Dependency versions across releases
What each release of this package resolved its children to. A child whose version moved is listed first: that is where an upgrade changed something underneath you.
| Library | 9.0.3 | 8.0.1 |
|---|---|---|
| cacache | 20.0.3 | 19.0.1 |
| json-parse-even-better-errors | 5.0.0 | 4.0.0 |
| pacote | 21.0.4 | 20.0.1 |
| proc-log | 6.1.0 | 5.0.0 |
| semver | 7.7.3 | 7.8.5 |
Moved: 5 · unchanged at every release: 0
An edge records that a resolver placed one release beside another on a real machine. It is not a claim that the two work together; that question is answered by samples and contracts, not by presence here.
Recent failure clusters
-
observed UNKNOWN exit 1 ERR_ASSERTION Evidence gap ×1 9.0.3 executionContext=node · moduleSystem=cjs · os=linux · runtime=node@22.23 sha256:986d98189e70…node:internal/modules/run_main:<n> · triggerUncaughtException( · ^ · AssertionError [ERR_ASSERTION]: Expected values to be strictly equal:node · unclassified-diagnostic · outer node · gap stage-unknownEvidence quality: complete · Environment variants: 1 · First recorded: 2026-09-14 · Last seen: 2026-09-14Diagnostic re-verification candidate