Repository: promptfoo/promptfoo
Issue: Version mismatch: CLI says latest is 0.119.13 but npm cannot install it (0.119.11 flagged as vulnerable)
Root cause: Configuration Error

**Describe the bug**
The Promptfoo CLI reports that there is a newer version `0.119.13` available and instructs me to run `npm install -g promptfoo@latest` or `npx promptfoo@latest`, but the npm registry only serves `0.119.11`. 

- `promptfoo --version` says:

The current version of promptfoo 0.119.11 is lower than the latest available version 0.119.13.
Please run npx promptfoo@latest or npm install -g promptfoo@latest to update.

- However, `npm install -g promptfoo@0.119.13` fails with `ETARGET: No matching version found for promptfoo@0.119.13`.
- `npm install -g promptfoo@latest` and `npx promptfoo@latest` both install `0.119.11` again.

So the CLI believes `0.119.13` is the latest version, but that version is not actually available on npm.

**To Reproduce**
Steps to reproduce the behavior:

1. Uninstall any existing global promptfoo:
 ```bash
 npm uninstall -g promptfoo
```
2. Try to install the version that the CLI claims is latest:
```bash
npm install -g promptfoo@0.119.13
```
Result:
```bash
npm error code ETARGET
npm error notarget No matching version found for promptfoo@0.119.13.
```

3. Install “latest” as suggested:
```
npm install -g promptfoo@latest
```

4.Check the installed version:
```
promptfoo --version
```
Output:
```
=========================================================================================================================
⚠️ The current version of promptfoo 0.119.11 is lower than the latest available version 0.119.13.

Please run npx promptfoo@latest or npm install -g promptfoo@latest to update.
=========================================================================================================================

0.119.11
```

5. Try npx as suggested:
```
npx promptfoo@latest
```
It attempts to install promptfoo@0.119.11 again and shows the same warning on --version.

**Expected behavior**

Either:
- `npm install -g promptfoo@latest` / `npx promptfoo@latest` should install 0.119.13 (and npm view promptfoo versions should show 0.119.13),

or

- If 0.119.13 is not yet published to npm, the CLI should not claim that 0.119.13 is the “latest available version” and should not instruct users to install it.

Right now the CLI recommends a version that cannot be installed via npm, which is confusing and breaks security workflows that require 0.119.13 (e.g. tools flagging 0.119.11 as vulnerable).

**Screenshots**
N/A — terminal logs are as above, happy to add screenshots if needed.

**System information:**
(I can’t run promptfoo debug on 0.119.13 because it’s not installable from npm; debug output on 0.119.11 would just reflect that version.)
- Promptfoo version: 0.119.11
- Install method: `npm install -g promptfoo@latest`
- OS: macOS (Apple Silicon)

**Additional context**
- A security scanner (Aikido safe-chain) is flagging `promptfoo@0.119.11` as having a serious vulnerability and requires upgrading to 0.119.13.
- The CLI itself insists that 0.119.13 is the latest version, but npm returns ETARGET for that version, and @latest resolves to 0.119.11.
- It looks like GitHub tags/releases and the npm registry are out of sync, and the CLI is checking GitHub (or another source) rather than what’s actually published to npm.

<p><a href="https://linear.app/promptfooo/issue/ENG-1103/version-mismatch-cli-says-latest-is-011913-but-npm-cannot-install-it">ENG-1103</a></p>

This is very unusual - I am not seeing this problem, but I very much want to hear if others are seeing it.  Are you by chance using some kind of npm proxy like artifactory, or nexus?  

Also just to be safe - mind running `npm cache clean --force` and giving this another go?

Thanks @JustinBeckwith, I realized it was a security npm proxy