fix: correctly resolve npm dist-tags latest using semver

pulp_npm/app/models.py

@@ -1,6 +1,8 @@
 import json
 from logging import getLogger
 
+import semver
+
 from aiohttp.web_response import Response
 from django.conf import settings
 from django.db import models
@@ -155,7 +157,10 @@ def content_handler(self, path):
             versions.append(package.version)
             data["versions"].update(version)
 
-        data["dist-tags"] = {"latest": max(versions)}
+        parsed = {v: semver.Version.parse(v) for v in versions if semver.Version.is_valid(v)}
+        stable_versions = [v for v, parsed_v in parsed.items() if not parsed_v.prerelease]
+        latest = max(stable_versions, key=parsed.get) if stable_versions else max(parsed, key=parsed.get)
+        data["dist-tags"] = {"latest": latest}
 
         serialized_data = json.dumps(data)
         return Response(body=serialized_data)

pulp_npm/app/utils.py

@@ -31,7 +31,7 @@ def extract_package_info(relative_path):
     Args:
         The relative_path string. "package/-/package-version.tgz"
     """
-    pattern = r"^(?P<name>@?[^/]+(?:/[^/]+)?)(?:/-/(?P<base_name>[^/]+)-(?P<version>[\d.]+)\.tgz)?$"
+    pattern = r"^(?P<name>@?[^/]+(?:/[^/]+)?)(?:/-/(?P<base_name>[^/]+?)-(?P<version>\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)\.tgz)?$"
     match = re.match(pattern, relative_path)
 
     if match:

pyproject.toml

@@ -26,6 +26,7 @@ classifiers=[
 requires-python = ">=3.11"
 dependencies = [
   "pulpcore>=3.105.0,<3.130",
+  "semver>=3.0.0",
 ]
 
 [project.urls]