apache / apache/maven

[MNG-7700] Improper canonicalization of versions

Open
#9,277 13 comments 0 reactions 0 assignees View on GitHub
bug priority:minor
Dominant language
Java
Stars
5.3k
Forks
3.1k
Avg merge
21h 11m
Merged PRs (30d)
312

Description

**[David M. Lloyd](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=dmlloyd)** opened **[MNG-7700](https://issues.apache.org/jira/browse/MNG-7700?redirect=false)** and commented

The canonicalization logic for versions is incorrect.

Using the method `ComparableVersion#getCanonical` as in `new ComparableVersion(input).getCanonical()`, the following results can be observed:

|Input|3.8.6 Output|3.8.6 OK?|3.9.0 Output|3.9.0 OK?|
|:---|:---|:---|:---|:---|
|`1`|`1`|yes|`1`|yes|
|`0.1`|`0.1`|yes|`0.1`|yes|
|`0-1`|`1`|no|`1`|no|
|`1.x`|`1.x`|yes|`1-x`|maybe*|
|`1-x`|`1-x`|yes|`1-x`|yes|
|`0.x`|`0.x`|yes|`x`|no|
|`0-x`|`x`|no|`x`|no|
|`x`|`x`|yes|`x`|yes|
|`0.rc`|`0.rc`|yes|`rc`|no|

The "OK?" columns indicate whether parsing the canonical version string will yield a `ComparableVersion` instance that is `equal` to one constructed from the original input, i.e. it's internally consistent.

The "maybe*" item indicates that starting with 3.9.0, version `1.x` is now considered to be equal to `1-x`. I'm not sure if this is a bug or not, or was intentional or not, but it is definitely a change.

These canonicalizations seem to have gotten less consistent in the move to 3.9.0.

---

**Affects:** 3.8.7, 3.9.0

**Issue Links:**
- [MNG-6964](https://issues.apache.org/jira/browse/MNG-6964) Maven version sorting is internally inconsistent

- [MNG-7644](https://issues.apache.org/jira/browse/MNG-7644) Fix version comparison where .X1 < -X2 for any string qualifier X

- [MNG-7701](https://issues.apache.org/jira/browse/MNG-7701) Incompatible version sorting changes

**Remote Links:**
- [GitHub Pull Request #1014
](https://github.com/apache/maven/pull/1014)

**Backported to:** [3.9.x-candidate](https://github.com/apache/maven/milestone/112?closed=1), waiting-for-feedback

Contributor guide

Open the contributing guide

Research direction

Start with ComparableVersion#getCanonical and reproduce the reported inputs across Maven 3.8.6 and 3.9.0. Review the linked issues MNG-6964, MNG-7644, and MNG-7701, plus pull request #1014, before deciding the expected behavior. Done means canonicalization is internally consistent for the listed cases and the 1.x versus 1-x change has an established resolution.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.