dedupe: respect dependency versions

Fixes issue #4675

1 files changed, 11 insertions, 7 deletions

diff --git a/lib/dedupe.js b/lib/dedupe.js
index 87afa938a..55823d967 100644
--- a/lib/dedupe.js
+++ b/lib/dedupe.js
@@ -249,10 +249,10 @@ function findVersions (npm, summary, cb) {
       var regVersions = er ? [] : Object.keys(data.versions)
       var locMatch = bestMatch(versions, ranges)
       var regMatch;
-      var tag = npm.config.get("tag");
-      var distTags = data["dist-tags"];
-      if (distTags && distTags[tag] && data.versions[distTags[tag]]) {
-        regMatch = distTags[tag]
+      var tag = npm.config.get("tag")
+      var distTag = data["dist-tags"] && data["dist-tags"][tag]
+      if (distTag && data.versions[distTag] && matches(distTag, ranges)) {
+        regMatch = distTag
       } else {
         regMatch = bestMatch(regVersions, ranges)
       }
@@ -262,11 +262,15 @@ function findVersions (npm, summary, cb) {
   }, cb)
 }
 
+function matches (version, ranges) {
+  return !ranges.some(function (r) {
+    return !semver.satisfies(version, r, true)
+  })
+}
+
 function bestMatch (versions, ranges) {
   return versions.filter(function (v) {
-    return !ranges.some(function (r) {
-      return !semver.satisfies(v, r, true)
-    })
+    return matches(v, ranges)
   }).sort(semver.compareLoose).pop()
 }