hashicorp / hashicorp/go-version
Invalid semver versions are treated as "valid"
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 1.8k
- Forks
- 165
- Avg merge
- 23h 42m
- Merged PRs (30d)
- 2
Description
As discovered by @rclark
The semver spec is clear that build or prerelease identifiers MUST come after a -.
Versions, such as the following
1.2.-3
1.2.03
1.2
1.2.3.4.5.6
1.2.3.alpha
1.2.3-preview.01
1.2.3-preview..1
1.2.3-preview!
1.2.3+one+two
1.2.3+one.2!
are treated as "valid". I intentionally put valid in quotes because it's clear that the internal representation of such a version is wrong anyway. All the consumer can reliably do with that parsed version is to call String() on it to reconstruct the same (invalid) version.
https://go.dev/play/p/hyp8ZZJQO8-
The Readme of go-version explicitly says
Versions used with go-version must follow SemVer.
Therefore I would treat this as a bug.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the Go version parser and its validation path, then compare its behavior with the SemVer requirements cited in the issue and the README. Add coverage for the listed invalid examples and ensure they are rejected while valid versions remain accepted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100