Version history shows semver compliance
Why it matters
A package stuck at version: 1.0.0 (the npm init default) with no changelog and no git tags has never been intentionally versioned. Consumers cannot tell whether 1.0.0 is stable or a placeholder, and cannot specify version constraints in their package.json with any confidence. Worse, breaking API changes shipped without a major bump silently break consumers on npm update — the canonical semver violation. ISO 25010 modifiability requires that the package's evolution be communicated through its version number.
Severity rationale
High because breaking changes without major version bumps silently break consumer projects on routine dependency updates, with no warning from the version range they specified.
Remediation
Set an intentional version and commit to the semver contract.
// Start at 0.1.0 if not yet stable, 1.0.0 when you're ready to commit to backward compat:
{ "version": "0.1.0" }
Semver rules:
- MAJOR (2.0.0): any breaking API change — removed export, changed parameter types, renamed symbol
- MINOR (1.1.0): new exports or features, backward-compatible
- PATCH (1.0.1): bug fixes, no API changes
Use npm version patch|minor|major to bump — it updates package.json and creates a git tag automatically. Version 0.0.0 or a placeholder that was never bumped intentionally fails this check.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the SDK / Package Quality Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.modifiability — Modifiability — semver communicates compatibility guarantees to consumers
- ssdf:800-218 · PS.3.2 — Archive and protect each software release with consistent versioning
Taxons
History
- 2026-04-18·v1.0.0·Initial import from sdk-package-quality·automated