tools/build.sh names each canary build <version>-canary.<short sha>. That causes two problems.
Details
- npm orders canaries by their hash, not their age. A short sha containing a letter is compared as text, so the order is alphabetical.
21.0.0-rc.0-canary.345726a, published 2026-09-21, ranks below 21.0.0-rc.0-canary.fb6796b, published 2026-08-20.- A short sha made only of digits is compared as a number, which ranks below every hash containing a letter. 11 published canaries have one.
- An all-digit hash that starts with 0 loses the zero.
npm version rewrites 21.0.0-canary.0123456 to 21.0.0-canary.123456, so the published name no longer matches the commit.
Scope
The order matters only when a version range matches canaries and nothing ranks above them, which is before a version's first release candidate. On the 21 line, the release candidates and the canaries named after them outrank every 21.0.0-canary.*, so this changes no install there.
tools/build.shnames each canary build<version>-canary.<short sha>. That causes two problems.Details
21.0.0-rc.0-canary.345726a, published 2026-09-21, ranks below21.0.0-rc.0-canary.fb6796b, published 2026-08-20.npm versionrewrites21.0.0-canary.0123456to21.0.0-canary.123456, so the published name no longer matches the commit.Scope
The order matters only when a version range matches canaries and nothing ranks above them, which is before a version's first release candidate. On the 21 line, the release candidates and the canaries named after them outrank every
21.0.0-canary.*, so this changes no install there.