Incorrect evaluation of pre-release version with dot-separated numeric against a <X.Y.Z constraint

[BenHayak]

Title

Incorrect evaluation of a pre-release version with a dot-separated numeric against a <X.Y.Z constraint.

Description

The semver library's Constraint.Check() method is incorrectly evaluating a pre-release version string that contains a dot-separated numeric identifier.

Specifically, the version 0.4.1-4.1 is evaluated as false by constraint.Check(v) when the constraint is <0.5.0. According to the Semantic Versioning 2.0.0 specification, pre-release versions have lower precedence than the normal version they are attached to. Therefore, 0.4.1-4.1 is less than 0.5.0, and the check should return true.

Steps to Reproduce

Use the Masterminds/semver Go library.

Define a version and a range constraint as shown in the code below.

Run the provided code snippet to check the behavior.

Code to Reproduce:

package main

import (
	"fmt"
	"log"

	"github.com/Masterminds/semver/v3"
)

func main() {
	// The version that is causing the issue
	testVersion := "0.4.1-4.1" 

	// The range constraint
	rangeStr := "<0.5.0"
	
	v, err := semver.NewVersion(testVersion)
	if err != nil {
		log.Fatalf("Error parsing test version: %v", err)
	}

	constraint, err := semver.NewConstraint(rangeStr)
	if err != nil {
		log.Fatalf("Error creating constraint: %v", err)
	}
	
	// Check the version against the constraint
	// This check should return `true` because `0.4.1-4.1` is less than `0.5.0`
	inRange := constraint.Check(v)
	
	fmt.Printf("Is version '%s' in range '%s'? %v\n", v, constraint, inRange)
}

Expected Behavior

The code should print:
Is version '0.4.1-4.1' in range '<0.5.0'? true

The Check() method should correctly identify that 0.4.1-4.1 is less than 0.5.0 and therefore falls within the range.

Actual Behavior

The code prints:
Is version '0.4.1-4.1' in range '<0.5.0'? false

The Check() method incorrectly evaluates 0.4.1-4.1 as a version that does not satisfy the constraint.

Environment

Go Version: go version go1.24.1 linux/amd64

Library Version: github.com/Masterminds/semver/v3

[mattfarina]

0.4.1-4.1 is a pre-release version. From the documentation:

Pre-release versions have a lower precedence than the associated normal version. A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as denoted by its associated normal version.

Because of the API incompatibilities most tooling, this library included, requires you to opt-in to including pre-releases in the checks. Doing a check against <0.5.0 does not provide this opt-in.

In your code you could include pre-releases with...

constraint.IncludePrerelease = true

Note, early versions of this package did not follow others and included pre-releases by default. This led to the deployment of pre-release software into production which was not the intent. Pre-release handling mirrors what other semver packages tend to do.