[BUG] npm i pkg@tag should save tag into package.json

[gemwuu]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Running $ npm i lodash.has@latest will save lodash.has@^4.5.2 into package.json.

Expected Behavior

Save lodash.has@latest into package.json.

Steps To Reproduce

1. npm i lodash.has@latest;
2. package.json depedencies.lodash.has will be ^4.5.2。

reason：users specify dist-tag installation should install the exact version that current dist-tag points to, not the moment when installation proceeds. If users want a semver of lodash.has, they should install with npm i lodash.has@^4.5.2.

Environment

• npm: 8.12.2
• Node.js: 16.13.0
• OS Name: macOS Big Sur(version: 11.2.3)
• System Model Name: MacBook Pro (16-inch, 2019)
• npm config:

; copy and paste output from `npm config ls` here
; "user" config from /Users/tianding.wk/.npmrc

//registry.npmjs.com/:_authToken = (protected)
//registry.npmjs.org/:_authToken = (protected)
email = ""
strict-ssl = false

; node bin location = /Users/tianding.wk/.nvm/versions/node/v16.13.0/bin/node
; node version = v16.13.0
; npm local prefix = /Users/tianding.wk/workspace/tnpmregistry
; npm version = 8.12.2
; cwd = /Users/tianding.wk/workspace/tnpmregistry
; HOME = /Users/tianding.wk
; Run `npm config ls -l` to show all defaults.

[ljharb]

You never want “latest” in package.json; that would break when a major version is published.

[killagu]

The latest tag is not a good case. latest-x or conch(which is antd stable version) is better.

[killagu]

users specify dist-tag installation should install the exact version that current dist-tag points to, not the moment when installation proceeds

The intent is important, for now we have to use npm install the pack and manually modify the package.json.

[killagu]

If users want a semver of lodash.has, they should install with npm i lodash.has@^4.5.2.

npm i lodash.has@^4.5.2 is unnecessary. If the input is npm i lodash.has, npm will use the latest version, and save it. It works good.

[fritzy]

This is working as intended. If we were to do this, packages would break regularly, breaking semantic versioning. If there's a feature that you want related to this, please open an RFC.

Can you create an RRFC in that rep with some details.