Skip to content

Properly handle the pre-release versions in VersionRange #130

Open
@keshav-space

Description

@keshav-space

The current univers VersionRange includes the pre-release versions. While this behavior is desirable when dealing with version ranges in a security advisory, it is not appropriate for the version range present in package manifests.

Scenario:

Consider the following release versions for an npm package:
1.0.0, 1.2.0, 2.0.0-rc.1, 2.0.0, 2.1.0, and 3.0.0

Desired Behavior:

  • When dealing with version ranges in a security advisory:
    2.0.0-rc.1 in vers:npm/>=1.2.0|<2.0.0 => True

  • When dealing with version ranges in manifest files:
    2.0.0-rc.1 in vers:npm/>=1.2.0|<2.0.0 => False

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions