[BUG]: 2.155.7 release notes list the fix for #3664, but 2.155.7 pins @salesforce/packaging 5.0.20 without it #3671

Before You Submit

• I'm using the latest version of Salesforce CLI
• I've searched the existing issues
• I've run sf doctor to diagnose common issues

Related Issue

#3664

Command

sf package uninstall --wait / sf package uninstall report (affected by #3664; I checked the installed files of an npm global install and did not run these commands against an org)

Org Type

Not applicable

Did this work before?

No, this is a new bug

Last Working Version

No response

Summary

Thank you for fixing #3664. This report is only about which release delivers the fix.

The release notes list the fix under 2.155.7 (October 21, 2026) [stable]:

FIX: sf package uninstall --wait and sf package uninstall report now show the actual uninstall failure details instead of a MALFORMED_QUERY error.

However, the 2.155.7 npm package does not include this fix:

• The npm-shrinkwrap.json in the 2.155.7 npm package pins @salesforce/packaging 5.0.20.
• The fix (fix: remove literal quotes from SOQL in getUninstallErrors-W-24463742 packaging#945) is first in @salesforce/packaging 5.0.21.

Timeline (UTC):

• 2026-10-14 02:39: @salesforce/cli 2.155.7 was published to npm.
• 2026-10-14 14:28: fix: remove literal quotes from SOQL in getUninstallErrors-W-24463742 packaging#945 was merged, about 12 hours later.
• 2026-10-14 14:29: [BUG]: sf package uninstall hides the real uninstall error behind MALFORMED_QUERY (regression since sfdx-cli 7.183.0) #3664 was closed as completed.
• 2026-10-14 14:31: @salesforce/packaging 5.0.21 was published.
• 2026-10-21: 2.155.7 became stable (the date in the release-notes heading). npm versions cannot change, so this is the same npm package that was published on October 14.

So the 2.155.7 npm package could not include the fix. With npm, 2.155.7 (the stable release as of October 24, 2026) still installs @salesforce/packaging 5.0.20, which has the old code, while the notes say it is fixed.

Repository to Reproduce

No repository is needed. The check needs no org and no project.

Steps to reproduce

With @salesforce/cli 2.155.7 installed globally with npm, run:

$ sf --version
@salesforce/cli/2.155.7 darwin-arm64 node-v22.18.0

$ npm ls -g @salesforce/packaging
~/.nvm/versions/node/v22.18.0/lib
└─┬ @salesforce/cli@2.155.7
  └─┬ @salesforce/plugin-packaging@3.0.14
    └── @salesforce/packaging@5.0.20


$ grep -n "PackageVersionUninstallRequestError" "$(npm root -g)/@salesforce/cli/node_modules/@salesforce/packaging/lib/package/packageUninstall.js"
33:    const errorQueryResult = await conn.tooling.query(`"SELECT Message FROM PackageVersionUninstallRequestError WHERE ParentRequest.Id = '${id}' ORDER BY Message"`);

Expected Result

The release notes list the fix under 2.155.7. So I expected 2.155.7 to install @salesforce/packaging 5.0.21 or later. In 5.0.21, line 33 of lib/package/packageUninstall.js has no extra double quotes around the query:

const errorQueryResult = await conn.tooling.query(`SELECT Message FROM PackageVersionUninstallRequestError WHERE ParentRequest.Id = '${id}' ORDER BY Message`);

If 2.155.7 cannot include the fix, I expected the release notes to list it under the release that includes it.

Actual Result

2.155.7 installs @salesforce/packaging 5.0.20. Line 33 of the installed packageUninstall.js still wraps the query in double quotes (see the output above). forcedotcom/packaging#945 removes these quotes.

Error Message

System Information

{
  "architecture": "darwin-arm64",
  "cliVersion": "@salesforce/cli/2.155.7",
  "nodeVersion": "node-v22.18.0",
  "osVersion": "Darwin 27.0.0",
  "rootPath": "~/.nvm/versions/node/v22.18.0/lib/node_modules/@salesforce/cli",
  "shell": "zsh",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 4.0.4 (core)",
    "@oclif/plugin-commands 5.0.4 (core)",
    "@oclif/plugin-help 7.0.4 (core)",
    "@oclif/plugin-not-found 4.0.4 (core)",
    "@oclif/plugin-plugins 7.0.7 (core)",
    "@oclif/plugin-search 2.0.0 (core)",
    "@oclif/plugin-update 5.0.4 (core)",
    "@oclif/plugin-version 3.0.5 (core)",
    "@oclif/plugin-warn-if-update-available 4.0.3 (core)",
    "@oclif/plugin-which 4.0.4 (core)",
    "@salesforce/analytics 1.4.85 (user) published 14 days ago (Sat Oct 10 2026)",
    "@salesforce/cli 2.155.7 (core)",
    "agent 2.2.2 (core)",
    "apex 4.4.3 (core)",
    "api 2.0.17 (core)",
    "auth 5.0.16 (core)",
    "community 4.0.13 (user) published 13 days ago (Sat Oct 10 2026) (latest is 4.0.14)",
    "data 5.1.16 (core)",
    "deploy-retrieve 4.2.14 (core)",
    "info 4.0.16 (core)",
    "limits 4.0.6 (core)",
    "marketplace 2.0.17 (core)",
    "org 6.0.26 (core)",
    "packaging 3.0.14 (core)",
    "schema 4.0.12 (core)",
    "settings 3.0.14 (core)",
    "sobject 2.0.12 (core)",
    "telemetry 4.2.0 (core)",
    "templates 57.4.6 (core)",
    "trust 4.0.20 (core)",
    "user 5.0.11 (core)"
  ]
}

Additional Information

Earlier releases with the same pattern. For each release below, I checked the npm-shrinkwrap.json in its published npm package. For the source-deploy-retrieve and source-tracking rows, I also compared the code of the pinned version with a fixed version. The only runtime change in salesforcecli/plugin-org#1775 is the open version range, so for that row I compared versions only.

The essence. In each of these cases, as in 2.155.7, the FIX is listed under a release whose npm-shrinkwrap.json pins a dependency version without the fix. In the earlier cases, the fix reached npm users in the next listed release, and that release's notes do not mention it.

About 2.156.x. The current release candidate, 2.156.7, no longer ships npm-shrinkwrap.json. A lockfile-only resolution of it on October 24 picked @salesforce/packaging 5.0.26, which includes this fix.

Requests:

1. Could you please confirm this? If it is confirmed, could you move this entry from 2.155.7 to the first release that includes @salesforce/packaging 5.0.21 or later (2.156.7, as far as I can tell)? (In that entry, the PR link points to salesforcecli/packaging, which returns 404; the PR is fix: remove literal quotes from SOQL in getUninstallErrors-W-24463742 packaging#945.)
2. As a gentle suggestion: it would help users if each FIX were listed under the first release that includes it.

Thank you very much for your work on Salesforce CLI.

Screenshots or Log Files

No response