I dunno if this is related to the above, but tilde range constraints don't help me here. I have specified

"fw1":"~4.2.0"

, which should only allow a maximum version of

4.2.∞

, yet it just installed

4.3.0

for me again. I'll try to just tie it down to a concrete

4.2.x

and see what happens...

I think the issue is with how the package/version is set up on ForgeBox. I haven't published a ForgeBox package in a while, but part of the process is providing the contents of a box.json. If the location key is included in the json string, it will override where ForgeBox goes to pull the package. At least that's my understanding. So if the json tied to the package/version contains the same location key telling it to look at the develop branch, like the box.json in the branch itself, that could be why it is pulling 4.3.0 in.

Sounds error prone. But the *box stuff is usually pretty solid so there might be a reason for it. I'd've thought the version value in the box.json would be the single source of truth. Ah well: it's not the most significant barrier to progress for me today anyhow. And I got past it.

@Adam Cameron The issue is in the configuration of the package. The

box.json

for the latest stable version of FW/1 on ForgeBox (4.2.0) has the following`

"location": "framework-one/fw1#master",

Which basically means, "W_hen you install this version, this is where you go to find me_". However, if we go and look at what is on the

master

branch in Github, we see the

box.json

committed there doesn't match

"version":"4.3.0",

https://github.com/framework-one/fw1/blob/master/box.json#L4 So the

location

of the

4.2.0

version of the package points to a place where the code for

4.3.0

lives which causes the issue. CommandBox will favor whatever version the downloaded code claims to be regardless of what version it was supposed to be on ForgeBox (though the two should never differ).

I suspected it was something like that.

This is what I figured. I'll mention it in the fw1 channel so it can be corrected.

Thanks pal.

The

box.json

needs to point to a tag for each version

"location": "framework-one/fw1#v4.2.0",

or, better yet, just use the inbuilt S3 storage that is available now (which is basically how npm works). Changing the

box.json

to either remove the

location

tag entirely or change it to

"location": "forgeboxStorage",

will mean when Sean runs

box publish

it will zip up exactly the code right then and put that zip file on S3 and there's no Git cloning involved, which makes it actually faster to install.

Pretty sure Steven Neiland is the only true maintainer now so I'll let him know. Not sure how/if he’s done anything with publishes to ForgeBox, but I'll help him get it sorted.

It would appear the entire publish to forgebox was forgotten for 4.3.0, but I'm happy to help him get forgebox straightened out if he needs

Thanks Brad I'll pass that along.

I've updated the location issue with the 4.2.0 release and will get 4.3.0 up on forgebox later tonight. Forgebox fell off my radar in terms of package management

Thanks @sneiland! I need to finish up a blog article, but almost done, and will check in 30min or so.

No problem