Canary builds are ordered by commit hash, not by time, and an all-digit hash loses its leading zero #3771

tools/build.sh names each canary build <version>-canary.<short sha>. That causes two problems.

Details

• npm orders canaries by their hash, not their age. A short sha containing a letter is compared as text, so the order is alphabetical.
  • 21.0.0-rc.0-canary.345726a, published 2026-09-21, ranks below 21.0.0-rc.0-canary.fb6796b, published 2026-08-20.
  • A short sha made only of digits is compared as a number, which ranks below every hash containing a letter. 11 published canaries have one.
• An all-digit hash that starts with 0 loses the zero. npm version rewrites 21.0.0-canary.0123456 to 21.0.0-canary.123456, so the published name no longer matches the commit.

Scope

The order matters only when a version range matches canaries and nothing ranks above them, which is before a version's first release candidate. On the 21 line, the release candidates and the canaries named after them outrank every 21.0.0-canary.*, so this changes no install there.