npm on an older Node installs old versions without telling you: four measured cases and other install traps
Running the same npm install on Node 20.19.2 and Node 24.22.1 gave different major versions of four packages (ai, @mastra/core, the MCP filesystem server and the MCP Inspector) because newer releases declare a higher Node requirement and npm picks the newest version that fits. There was no error. We also hit an undeclared dependency, an unpinned dependency that broke a package, a missing prebuilt wheel, and a sampling setting that looked like a framework failure.
Measured by us on 2026-10-25. Local open-weight models on a CPU-only box; nothing is vendor-reported. Smoke tests, not benchmarks.
Same command, different packages
We ran npm install for each package on Node 20.19.2 and again on Node 24.22.1, with an empty cache. npm's resolver skips versions whose declared engines do not match the running Node, and installs the newest one that does, without an error message. Checking with npm view confirmed the declared requirements.
| Package | Installed on Node 20 | Latest (checked 2026-10-25) | Latest declares | Installed on Node 24 |
|---|---|---|---|---|
| ai | 6.0.315 | 7.0.153 | >=22 | 7.0.153 |
| @mastra/core | 0.24.9 | 1.79.0 | >=22.13 | 1.79.0 |
| @modelcontextprotocol/server-filesystem | 1.0.0 | 2.0.1 | >=24 | 2.0.1 |
| @modelcontextprotocol/inspector | 0.15.0 | 2.12.0 | >=22.19 | 2.12.0 |
Effect on our results: the Vercel AI SDK script ran unchanged on 6.0.315 and 7.0.153 and passed both times; the MCP filesystem server answered about 90 ms faster at startup on 2.x. A tutorial written for the new version may not match what an older Node installs, and the package name gives no hint.
Other install and run traps we hit
| Trap | Tool | What happened | Fix |
|---|---|---|---|
| Undeclared dependency | litellm | Importing the MCP integration failed until we installed the mcp package ourselves | uv pip install mcp |
| Unpinned dependency | faster-whisper | av 19.0.2 raised a TypeError on first use | pin av==18.1.0 |
| No prebuilt wheel plus no compiler | aider | Install on Python 3.13 failed: meson could not find a C++ compiler | use Python 3.12 or install a compiler |
| Native module build failed | flowise | npm install on Node 24 failed after 106 s with a node-gyp error building better-sqlite3 | a C++ toolchain is probably needed; we did not try |
| Optional extra needed | smolagents | Using an OpenAI-compatible server raised ModuleNotFoundError: Please install 'openai' extra | pip install smolagents[openai] |
| Different default behaviour | MCP Fetch | Refuses loopback addresses by default | --allow-private-ips for local tests only |
| Plugin-prefixed names | Semantic Kernel | Model called add_numbers while the tool was named math-add_numbers; empty reply | name the exact tool in the prompt |
| Cache fooled the timing | DSPy | A first run looked fast because LM calls are cached | configure the cache off for tests |
| Changed class path | MCP Python SDK | A 1.x import failed to start under SDK 2.3.0 | use mcp.server.mcpserver.MCPServer |
A setting that looked like a framework failure
With default sampling, the JavaScript OpenAI Agents SDK passed 2 of 5 trials on Node 20 and 1 of 5 on Node 24, and Mastra passed 0 of 3 and 1 of 3. Every failure was an empty reply with no tool call. After adding temperature 0 to the call (the only change), both frameworks passed 5 of 5 on both Node versions. Had we stopped at the first run we would have published a wrong conclusion about two frameworks. See the framework study for the full table.
Practical rule: before you blame a tool for a bad result with a small local model, pin the temperature, print the installed version and check the raw request and response.
Caveats
- This is a list of what we hit on one machine on 2026-10-25; versions move daily.
- The Node 20 installs were from the same registry on the same day as the Node 24 installs, so the only difference is the Node version.
- We did not test other package managers, other Node versions (22, for example) or lockfile behaviour.
FAQ
Why did npm install an older version of a package on Node 20?
Newer releases of ai, @mastra/core, the MCP filesystem server and the MCP Inspector declare a higher Node requirement than 20.19.2, and npm installs the newest version whose requirement is met, without an error.
How can I check which version I actually got?
Run npm ls <package> after installing, or print the version your server or CLI reports.
Related
Page history
- : First published.
Markdown version for agents: /research/older-node-silent-downgrades.md