dotnet libman update installs deprecated package versions

[LiteracyFanatic]

Describe the bug

If a deprecated version of a package exists with a higher version number than the currently installed version, the tool will install the deprecated version. This only seems to happen with the cdnjs provider.

To Reproduce

Steps to reproduce the behavior:

1. Add the following entry under libraries in libman.json:

    {
      "provider": "cdnjs",
      "library": "[email protected]",
      "destination": "wwwroot/assets/libs/datatables.net"
    }

2. Run dotnet libman update datatables.net and the command will update to version 2.1.1 which is deprecated.

Expected behavior

Deprecated package versions should be ignored when updating.

Additional context

2.1.175+29a28921bd.RR

[jimmylewis]

With CDNJS, the data used by libman comes from their catalog curation. In this case, CDNJS that says 2.1.1 is the latest version, and there's no indication from their API that it's been deprecated.

You could try sending them feedback via https://github.com/cdnjs/cdnjs/issues to either set another version as latest, or to add a feature to include deprecation metadata so that libman could consume that and exclude deprecated versions.