[MeAkib]

Modern yarn returns the manifest of the latest version instead of an error when the requested version or range does not exist (for example, yarn npm info @angular/core@99.99.99 prints the latest version with exit code 0). As a result, ng add and ng update could continue with an unrelated version instead of reporting that the requested version does not exist.

Return null from getRegistryManifest when the fetched version does not satisfy the requested version or range.

[gemini-code-assist]

Code Review

This pull request addresses an issue where modern yarn returns the latest version instead of throwing an error when a requested package version does not exist. It adds a check in PackageManager.getRegistryManifest to return null if the fetched manifest version does not satisfy the requested version range, and includes corresponding unit tests. Feedback suggests defensively validating manifest.version using valid() before calling satisfies to prevent potential runtime TypeError crashes.

[gemini-code-assist]

semver.satisfies throws a TypeError if the version argument is not a valid semver string. To prevent potential runtime crashes when encountering malformed or unexpected registry manifests, we should defensively verify that manifest.version is valid using valid(manifest.version) before calling satisfies.

Suggested change

	if (
	manifest &&
	validRange(version) &&
	!satisfies(manifest.version, version, { includePrerelease: true })
	) {
	return null;
	}
	if (
	manifest &&
	valid(manifest.version) &&
	validRange(version) &&
	!satisfies(manifest.version, version, { includePrerelease: true })
	) {
	return null;
	}