hashicorp / hashicorp/go-version

~> Constraint Operator Does Not Apply Upper Bound for Major-Only Versions (e.g., “~> 18” includes 19.0.0)

Open
#162 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.8k
Forks
165
Avg merge
23h 42m
Merged PRs (30d)
2

Description

When using the ~> (pessimistic constraint) operator with a major-only version, the upper bound is not correctly enforced.

According to semver convention, a constraint like ~> 18 should translate to:
`>= 18.0.0, < 19.0.0`
However, the current implementation allows 19.0.0 to match ~> 18, which is unexpected and inconsistent with ~> behavior for more specific version formats like ~> 1.2.3.

✅ Expected Behavior
```
constraint, _ := version.NewConstraint("~> 18")
v, _ := version.NewVersion("19.0.0")
fmt.Println(constraint.Check(v)) // Expected: false
```

❌ Actual Behavior
```
constraint, _ := version.NewConstraint("~> 18")
v, _ := version.NewVersion("19.0.0")
fmt.Println(constraint.Check(v)) // Actual: true ❌
```

Playground repro: https://go.dev/play/p/wH5SGj61036

🙏 Request

Please fix the parsing logic for ~> constraints to properly enforce the upper bound when only a major version is provided.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.