From 046da7f527cc72a482b5dea8cb59392be65bf186 Mon Sep 17 00:00:00 2001 From: xuyan wang <35394786+wayyoungboy@users.noreply.github.com> Date: Mon, 8 Jun 2026 23:10:17 +0800 Subject: [PATCH 1/3] fix: align caret includePrerelease lower bounds (#872) ## Summary - keep exact caret lower bounds at the release version when `includePrerelease` is enabled - add regression fixtures for `^0.0.3` and `^0.2.3` prerelease versions matching the existing `^1.0.0` behavior ## Root Cause For exact `0.x` caret ranges without an explicit prerelease, `replaceCaret` appended `-0` to the lower bound when `includePrerelease` was enabled. That turned `^0.0.3` into `>=0.0.3-0 <0.0.4-0`, allowing `0.0.3-alpha` while exact `1.x` caret ranges kept `>=1.2.3` and rejected `1.2.3-alpha`. ## Test Plan - RED: Node assert script confirmed `satisfies('0.0.3-alpha', '^0.0.3', { includePrerelease: true })` returned `true` before the fix - GREEN: Node assert script for `0.0.3-alpha`, `0.2.3-alpha`, and `1.2.3-alpha` all returning `false` - `node` fixture script covering range include/exclude fixtures: 121 include and 98 exclude cases - broader `node` range verification script: 1348 checks across range parsing, intersects, outside/gtr/ltr, min/max satisfying, and toComparators - `git diff --check HEAD^ HEAD` Fixes #557 --- classes/range.js | 4 ++-- test/fixtures/range-exclude.js | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/classes/range.js b/classes/range.js index c2e605e5..1efaaf2c 100644 --- a/classes/range.js +++ b/classes/range.js @@ -373,10 +373,10 @@ const replaceCaret = (comp, options) => { if (M === '0') { if (m === '0') { ret = `>=${M}.${m}.${p - }${z} <${M}.${m}.${+p + 1}-0` + } <${M}.${m}.${+p + 1}-0` } else { ret = `>=${M}.${m}.${p - }${z} <${M}.${+m + 1}.0-0` + } <${M}.${+m + 1}.0-0` } } else { ret = `>=${M}.${m}.${p diff --git a/test/fixtures/range-exclude.js b/test/fixtures/range-exclude.js index c28cc98e..a4b92d1d 100644 --- a/test/fixtures/range-exclude.js +++ b/test/fixtures/range-exclude.js @@ -79,6 +79,8 @@ module.exports = [ ['>=2', false], ['2.x', '3.0.0-pre.0', { includePrerelease: true }], + ['^0.0.3', '0.0.3-alpha', { includePrerelease: true }], + ['^0.2.3', '0.2.3-alpha', { includePrerelease: true }], ['^1.0.0', '1.0.0-rc1', { includePrerelease: true }], ['^1.0.0', '2.0.0-rc1', { includePrerelease: true }], ['^1.2.3-rc2', '2.0.0', { includePrerelease: true }], From 3485ddadb2ca0d0691392ee5ce620072e1b1e040 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 8 Jun 2026 08:18:33 -0700 Subject: [PATCH 2/3] chore: bump @npmcli/eslint-config from 6.0.1 to 7.0.0 (#866) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [@npmcli/eslint-config](https://github.com/npm/eslint-config) from 6.0.1 to 7.0.0.
Release notes

Sourced from @​npmcli/eslint-config's releases.

v7.0.0

7.0.0 (2026-05-15)

⚠️ BREAKING CHANGES

Features

Dependencies

Chores

Changelog

Sourced from @​npmcli/eslint-config's changelog.

7.0.0 (2026-05-15)

⚠️ BREAKING CHANGES

Features

Dependencies

Chores

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@npmcli/eslint-config&package-manager=npm_and_yarn&previous-version=6.0.1&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index bcb65da6..cbeffa18 100644 --- a/package.json +++ b/package.json @@ -14,7 +14,7 @@ "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"" }, "devDependencies": { - "@npmcli/eslint-config": "^6.0.0", + "@npmcli/eslint-config": "^7.0.0", "@npmcli/template-oss": "5.0.0", "benchmark": "^2.1.4", "tap": "^16.0.0" From 6b77aa84a648a4b54ea32a21e6db60ebd54d5040 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 8 Jun 2026 08:26:10 -0700 Subject: [PATCH 3/3] chore: release 7.8.3 (#873) :robot: I have created a release *beep* *boop* --- ## [7.8.3](https://github.com/npm/node-semver/compare/v7.8.2...v7.8.3) (2026-06-08) ### Bug Fixes * [`046da7f`](https://github.com/npm/node-semver/commit/046da7f527cc72a482b5dea8cb59392be65bf186) [#872](https://github.com/npm/node-semver/pull/872) align caret includePrerelease lower bounds (#872) (@wayyoungboy) ### Chores * [`3485dda`](https://github.com/npm/node-semver/commit/3485ddadb2ca0d0691392ee5ce620072e1b1e040) [#866](https://github.com/npm/node-semver/pull/866) bump @npmcli/eslint-config from 6.0.1 to 7.0.0 (#866) (@dependabot[bot]) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .release-please-manifest.json | 2 +- CHANGELOG.md | 6 ++++++ package.json | 2 +- 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 3ebad252..a594600f 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "7.8.2" + ".": "7.8.3" } diff --git a/CHANGELOG.md b/CHANGELOG.md index e7ee8ad4..d69cb4aa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## [7.8.3](https://github.com/npm/node-semver/compare/v7.8.2...v7.8.3) (2026-06-08) +### Bug Fixes +* [`046da7f`](https://github.com/npm/node-semver/commit/046da7f527cc72a482b5dea8cb59392be65bf186) [#872](https://github.com/npm/node-semver/pull/872) align caret includePrerelease lower bounds (#872) (@wayyoungboy) +### Chores +* [`3485dda`](https://github.com/npm/node-semver/commit/3485ddadb2ca0d0691392ee5ce620072e1b1e040) [#866](https://github.com/npm/node-semver/pull/866) bump @npmcli/eslint-config from 6.0.1 to 7.0.0 (#866) (@dependabot[bot]) + ## [7.8.2](https://github.com/npm/node-semver/compare/v7.8.1...v7.8.2) (2026-06-04) ### Bug Fixes * [`bea6028`](https://github.com/npm/node-semver/commit/bea6028694a75e840f48b288ac019e9644cfe6e8) [#870](https://github.com/npm/node-semver/pull/870) increment dotted prerelease identifiers (#870) (@liuzemei, @SheldonNeo) diff --git a/package.json b/package.json index cbeffa18..a5a57a14 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "semver", - "version": "7.8.2", + "version": "7.8.3", "description": "The semantic version parser used by npm.", "main": "index.js", "scripts": {