[BUG] `npm view $package versions --json` returns non-JSON string for packages with only one version

[jayeb]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

As of 7.20.0, querying the versions field with the --json flag (npm view $package versions --json) for a package with only one published version will return a single string value, which is not parseable as JSON.

Expected Behavior

In versions prior to 7.20.0, querying the versions field with the --json flag (npm view $package versions --json) for a package with only one published version would return an array with a single string, which is parseable as JSON.

Steps To Reproduce

1. Using npm 7.20.X, run npm view $package versions --json for a package with only one published version.
   • For example: npm view @types/spdx-satisfies versions --json
2. Note that the stdout response contains a single string, rather than an array.

For comparison:

1. Using npm 7.19.X, run npm view $package versions --json for a package with only one published version.
   • For example: npm view @types/spdx-satisfies versions --json
2. Note that the stdout response is valid JSON: a single string wrapped in an array.

Environment

• OS: macOS 11.4
• Node: 14.17.0
• npm: 7.20.1

[jayeb]

My colleague and I poked around at this a little bit. As best we can tell, this change was introduced in #3487 when the new npm pkg command was added and the npm view command's output was changed to use the new Queryable interface.

This bit here seems relevant--it looks like it would create the exact behavior we're seeing. But the comment about "legacy expectations" muddies the water a bit, as does this part of the old view code that seems to replicate the exact behavior that isn't present in 7.19.X.

I'm not sure where to go from here, but hopefully these crumbs help.

[msimerson]

I just ran into this silly bug.

Please make npm view $package versions --json always return a valid JSON array.

That is what is expected when the arguments version_s_ is specified. It currently falls over on its face, returning only a quoted string.