fix: key stage download --json output by package name (v11) by reggi · Pull Request #9381 · npm/cli

reggi · 2026-05-20T18:32:18Z

Backports #9380 to release/v11 to keep npm stage download --json output consistent across branches.

On release/v11, the key == null guard in lib/utils/tar.js was emitting the bare object (no wrapper key). This change adds a key so the output matches latest and aligns with npm publish --json / npm pack --json.

Before (on release/v11)

{
  "name": "polo-meow-meow-meow",
  "version": "1.0.3",
  ...
}

After

{
  "polo-meow-meow-meow": {
    "name": "polo-meow-meow-meow",
    "version": "1.0.3",
    ...
  }
}

Background

The key == null fallback in lib/utils/tar.js (still present on release/v11) was removed from latest in #9247 ("fix: sync json output of pack and publish") as a BREAKING CHANGE. Per that PR:

BREAKING CHANGE: the --json output of npm pack and npm publish have changed. They are now always consistent, and in the same format.

Previously, npm pack would output an array of entries and npm publish an object. The npm publish object also changed forms depending on if workspaces were being published.

Now, the output is always an object with the package name as the top level index.

That breaking change was intentionally not backported to v11 (maintenance branch), so the fallback still exists here. This backport keeps the call-site contract aligned across branches so consumers get the same { "<pkg>": {...} } shape on both.

Clean cherry-pick of 9f7834d from #9380.

`npm stage download <id> --json` was emitting the package contents under a literal "undefined" key because `logTar` is called without a `key` option. Pass `pkgContents.name` so the JSON output is keyed by the package name, matching `npm publish --json` and `npm pack --json`. Co-authored-by: Copilot <[email protected]> (cherry picked from commit 9f7834d)

After PR #9381 makes every caller pass `key`, the `key == null` true branch in lib/utils/tar.js is no longer exercised by callers. Add a direct unit test for logTar with json:true and no key so branch coverage stays at 100%. Co-authored-by: Copilot <[email protected]>

`npm stage download <id> --json` currently emits the package contents under a literal `"undefined"` key because `logTar` is called without a `key` option. ### Before ```json { "undefined": { "name": "polo-meow-meow-meow", "version": "1.0.3", ... } } ``` ### After ```json { "polo-meow-meow-meow": { "name": "polo-meow-meow-meow", "version": "1.0.3", ... } } ``` This matches the JSON shape of `npm publish --json` and `npm pack --json`. ### Background The `key == null` fallback in `lib/utils/tar.js` (that would have rendered a bare object when no key was passed) was removed from `latest` in #9247 ("fix: sync json output of pack and publish") as a `BREAKING CHANGE`. Per that PR: > BREAKING CHANGE: the --json output of `npm pack` and `npm publish` have changed. They are now always consistent, and in the same format. > > Previously, `npm pack` would output an array of entries and `npm publish` an object. The `npm publish` object also changed forms depending on if workspaces were being published. > > Now, the output is always an object with the package name as the top level index. When #9201 (npm stage) landed, it added a new `logTar` caller in `lib/commands/stage/download.js` that did not pass a `key`, silently violating the v12 contract established in #9247 and producing the `"undefined"` wrapper. This PR brings the new caller into compliance. ### Repro ``` npm stage download <stage-id> --json ``` A follow-up backports this to `release/v11` for consistent output across branches: #9381. Co-authored-by: Copilot <[email protected]>

@JamieMagee

@JamieMagee

@JamieMagee

@Tayvon

@Tayvon

reggi requested review from a team as code owners May 20, 2026 18:32

reggi changed the title ~~[Backport release/v11] fix(stage): key download --json output by package name~~ fix: key stage download --json output by package name (v11) May 20, 2026

reggi mentioned this pull request May 20, 2026

fix: key stage download --json output by package name #9380

Merged

nishantms approved these changes May 20, 2026

View reviewed changes

reggi merged commit 39b625e into release/v11 May 20, 2026
20 checks passed

reggi deleted the backport/v11/stage-download-json-key branch May 20, 2026 18:52

github-actions Bot mentioned this pull request May 20, 2026

chore: release 11.15.0 #9339

Merged

npm-cli-bot mentioned this pull request May 20, 2026

deps: upgrade npm to 11.15.0 nodejs/node#63463

Merged

coderabbitai Bot mentioned this pull request Aug 25, 2026

ci: enforce three mandatory package quality gates veryfront/veryfront-code#4126

Merged

Navigation Menu

Repository navigation

fix: key stage download --json output by package name (v11) - #9381

fix: key stage download --json output by package name (v11)#9381
reggi merged 2 commits into
release/v11from
backport/v11/stage-download-json-key

reggi commented May 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

reggi commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Before (on release/v11)

After

Background

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

reggi commented May 20, 2026 •

edited

Loading