From 3b03e3b4ecb28d609cd42a91c10da75ec1254976 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 26 Jun 2025 11:47:42 -0700 Subject: [PATCH 1/6] chore: bump @npmcli/template-oss from 4.24.3 to 4.24.4 (#790) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [@npmcli/template-oss](https://github.com/npm/template-oss) from 4.24.3 to 4.24.4.
Release notes

Sourced from @​npmcli/template-oss's releases.

v4.24.4

4.24.4 (2025-06-25)

Bug Fixes

Changelog

Sourced from @​npmcli/template-oss's changelog.

4.24.4 (2025-06-25)

Bug Fixes

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@npmcli/template-oss&package-manager=npm_and_yarn&previous-version=4.24.3&new-version=4.24.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
--------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: npm CLI robot --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index 1fbef5a9..a8fc0f32 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,7 @@ }, "devDependencies": { "@npmcli/eslint-config": "^5.0.0", - "@npmcli/template-oss": "4.24.3", + "@npmcli/template-oss": "4.24.4", "benchmark": "^2.1.4", "tap": "^16.0.0" }, @@ -52,7 +52,7 @@ "author": "GitHub Inc.", "templateOSS": { "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", - "version": "4.24.3", + "version": "4.24.4", "engines": ">=10", "distPaths": [ "classes/", From d17aebf8485edfe9dda982dab578c603d031e4ab Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 9 Jul 2025 09:44:08 -0700 Subject: [PATCH 2/6] chore: bump @npmcli/template-oss from 4.24.4 to 4.25.0 (#797) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [@npmcli/template-oss](https://github.com/npm/template-oss) from 4.24.4 to 4.25.0.
Release notes

Sourced from @​npmcli/template-oss's releases.

v4.25.0

4.25.0 (2025-07-08)

Features

Changelog

Sourced from @​npmcli/template-oss's changelog.

4.25.0 (2025-07-08)

Features

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@npmcli/template-oss&package-manager=npm_and_yarn&previous-version=4.24.4&new-version=4.25.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
--------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Michael Smith --- .github/workflows/post-dependabot.yml | 2 +- package.json | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/post-dependabot.yml b/.github/workflows/post-dependabot.yml index 1ea8693c..3a919116 100644 --- a/.github/workflows/post-dependabot.yml +++ b/.github/workflows/post-dependabot.yml @@ -54,7 +54,7 @@ jobs: else # strip leading slash from directory so it works as a # a path to the workspace flag - echo "workspace=-w ${dependabot_dir#/}" >> $GITHUB_OUTPUT + echo "workspace=--workspace ${dependabot_dir#/}" >> $GITHUB_OUTPUT fi - name: Apply Changes diff --git a/package.json b/package.json index a8fc0f32..e1c60238 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,7 @@ }, "devDependencies": { "@npmcli/eslint-config": "^5.0.0", - "@npmcli/template-oss": "4.24.4", + "@npmcli/template-oss": "4.25.0", "benchmark": "^2.1.4", "tap": "^16.0.0" }, @@ -52,7 +52,7 @@ "author": "GitHub Inc.", "templateOSS": { "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", - "version": "4.24.4", + "version": "4.25.0", "engines": ">=10", "distPaths": [ "classes/", From 8f05c87f56a4123259b8c6d9324f53eadb02e48f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 19 Sep 2025 08:52:03 -0700 Subject: [PATCH 3/6] chore: bump @npmcli/template-oss from 4.25.0 to 4.25.1 (#807) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [@npmcli/template-oss](https://github.com/npm/template-oss) from 4.25.0 to 4.25.1.
Release notes

Sourced from @​npmcli/template-oss's releases.

v4.25.1

4.25.1 (2025-09-18)

Bug Fixes

Dependencies

Changelog

Sourced from @​npmcli/template-oss's changelog.

4.25.1 (2025-09-18)

Bug Fixes

Dependencies

Commits
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​npmcli/template-oss since your current version.


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@npmcli/template-oss&package-manager=npm_and_yarn&previous-version=4.25.0&new-version=4.25.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
--------- Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Michael Smith --- package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index e1c60238..72d476bb 100644 --- a/package.json +++ b/package.json @@ -15,7 +15,7 @@ }, "devDependencies": { "@npmcli/eslint-config": "^5.0.0", - "@npmcli/template-oss": "4.25.0", + "@npmcli/template-oss": "4.25.1", "benchmark": "^2.1.4", "tap": "^16.0.0" }, @@ -52,7 +52,7 @@ "author": "GitHub Inc.", "templateOSS": { "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", - "version": "4.25.0", + "version": "4.25.1", "engines": ">=10", "distPaths": [ "classes/", From 2471d7543e2e63d9d95358e2405e7e1cde926c36 Mon Sep 17 00:00:00 2001 From: i529015 Date: Wed, 24 Sep 2025 13:21:26 +0530 Subject: [PATCH 4/6] fix: x-range build metadata support --- classes/range.js | 1 + test/fixtures/range-parse.js | 28 ++++++++++++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/classes/range.js b/classes/range.js index f80c2359..94629ce6 100644 --- a/classes/range.js +++ b/classes/range.js @@ -255,6 +255,7 @@ const isSatisfiable = (comparators, options) => { // already replaced the hyphen ranges // turn into a set of JUST comparators. const parseComparator = (comp, options) => { + comp = comp.replace(re[t.BUILD], '') debug('comp', comp, options) comp = replaceCarets(comp, options) debug('caret', comp) diff --git a/test/fixtures/range-parse.js b/test/fixtures/range-parse.js index 3fdd5ff2..e4e252d7 100644 --- a/test/fixtures/range-parse.js +++ b/test/fixtures/range-parse.js @@ -88,4 +88,32 @@ module.exports = [ [`^${MAX_SAFE_INTEGER}.0.0`, null], [`=${MAX_SAFE_INTEGER}.0.0`, `${MAX_SAFE_INTEGER}.0.0`], [`^${MAX_SAFE_INTEGER - 1}.0.0`, `>=${MAX_SAFE_INTEGER - 1}.0.0 <${MAX_SAFE_INTEGER}.0.0-0`], + // x-ranges with build metadata + ['1.x.x+build >2.x+build', '>=1.0.0 <2.0.0-0 >=3.0.0', null], + ['>=1.x+build <2.x.x+build', '>=1.0.0 <2.0.0-0', null], + ['1.x.x+build || 2.x.x+build', '>=1.0.0 <2.0.0-0||>=2.0.0 <3.0.0-0', null], + ['1.x+build.123', '>=1.0.0 <2.0.0-0', null], + ['1.x.x+meta-data', '>=1.0.0 <2.0.0-0', null], + ['1.x.x+build.123 >2.x.x+meta-data', '>=1.0.0 <2.0.0-0 >=3.0.0', null], + ['1.x.x+build <2.x.x+meta', '>=1.0.0 <2.0.0-0', null], + ['>1.x+build <=2.x.x+meta', '>=2.0.0 <3.0.0-0', null], + [' 1.x.x+build >2.x.x+build ', '>=1.0.0 <2.0.0-0 >=3.0.0', null], + ['^1.x+build', '>=1.0.0 <2.0.0-0', null], + ['^1.x.x+build', '>=1.0.0 <2.0.0-0', null], + ['^1.2.x+build', '>=1.2.0 <2.0.0-0', null], + ['^1.x+meta-data', '>=1.0.0 <2.0.0-0', null], + ['^1.x.x+build.123', '>=1.0.0 <2.0.0-0', null], + ['~1.x+build', '>=1.0.0 <2.0.0-0', null], + ['~1.x.x+build', '>=1.0.0 <2.0.0-0', null], + ['~1.2.x+build', '>=1.2.0 <1.3.0-0', null], + ['~1.x+meta-data', '>=1.0.0 <2.0.0-0', null], + ['~1.x.x+build.123', '>=1.0.0 <2.0.0-0', null], + ['^1.x.x+build || ~2.x.x+meta', '>=1.0.0 <2.0.0-0||>=2.0.0 <3.0.0-0', null], + ['~1.x.x+build >2.x+meta', '>=1.0.0 <2.0.0-0 >=3.0.0', null], + ['^1.x+build.123 <2.x.x+meta-data', '>=1.0.0 <2.0.0-0', null], + // // x-ranges with prerelease and build + ['1.x.x-alpha+build', '>=1.0.0 <2.0.0-0', null], + ['>1.x.x-alpha+build', '>=2.0.0', null], + ['>=1.x.x-alpha+build <2.x.x+build', '>=1.0.0 <2.0.0-0', null], + ['1.x.x-alpha+build || 2.x.x+build', '>=1.0.0 <2.0.0-0||>=2.0.0 <3.0.0-0', null], ] From e37e0ca0b5fc910d2b1948d25dbc83cc3a0921ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vinicius=20Louren=C3=A7o?= <12551007+H4ad@users.noreply.github.com> Date: Sun, 5 Oct 2025 22:04:45 -0300 Subject: [PATCH 5/6] fix: faster paths for compare (#813) --- benchmarks/bench-compare.js | 40 +++++------------------------------- benchmarks/bench-parse.js | 13 ++++++------ classes/semver.js | 24 +++++++++++++++++----- internal/identifiers.js | 4 ++++ test/internal/identifiers.js | 3 +++ 5 files changed, 37 insertions(+), 47 deletions(-) diff --git a/benchmarks/bench-compare.js b/benchmarks/bench-compare.js index 81db8c24..ec75f2d3 100644 --- a/benchmarks/bench-compare.js +++ b/benchmarks/bench-compare.js @@ -4,45 +4,15 @@ const Benchmark = require('benchmark') const SemVer = require('../classes/semver') const suite = new Benchmark.Suite() -const versions = ['1.0.3', '2.2.2', '2.3.0'] -const versionToCompare = '1.0.2' -const option1 = { includePrelease: true } -const option2 = { includePrelease: true, loose: true } -const option3 = { includePrelease: true, loose: true, rtl: true } +const comparisons = require('../test/fixtures/comparisons') -for (const version of versions) { - suite.add(`compare ${version} to ${versionToCompare}`, function () { - const semver = new SemVer(version) - semver.compare(versionToCompare) +for (const [v0, v1] of comparisons) { + suite.add(`compare ${v0} to ${v1}`, function () { + const semver = new SemVer(v0) + semver.compare(v1) }) } -for (const version of versions) { - suite.add( - `compare ${version} to ${versionToCompare} with option (${JSON.stringify(option1)})`, - function () { - const semver = new SemVer(version, option1) - semver.compare(versionToCompare) - }) -} - -for (const version of versions) { - suite.add(`compare ${version} to ${versionToCompare} with option (${JSON.stringify(option2)})`, - function () { - const semver = new SemVer(version, option2) - semver.compare(versionToCompare) - }) -} - -for (const version of versions) { - suite.add( - `compare ${version} to ${versionToCompare} with option (${JSON.stringify(option3)})`, - function () { - const semver = new SemVer(version, option3) - semver.compare(versionToCompare) - }) -} - suite .on('cycle', function (event) { console.log(String(event.target)) diff --git a/benchmarks/bench-parse.js b/benchmarks/bench-parse.js index af10ec52..5756eee2 100644 --- a/benchmarks/bench-parse.js +++ b/benchmarks/bench-parse.js @@ -2,21 +2,20 @@ const Benchmark = require('benchmark') const parse = require('../functions/parse') -const { MAX_SAFE_INTEGER } = require('../internal/constants') const suite = new Benchmark.Suite() -const cases = ['1.2.1', '1.2.2-4', '1.2.3-pre'] -const invalidCases = [`${MAX_SAFE_INTEGER}0.0.0`, 'hello, world', 'xyz'] +const cases = require(`../test/fixtures/valid-versions`) +const invalidCases = require(`../test/fixtures/invalid-versions`) for (const test of cases) { - suite.add(`parse(${test})`, function () { - parse(test) + suite.add(`parse(${test[0]})`, function () { + parse(test[0]) }) } for (const test of invalidCases) { - suite.add(`invalid parse(${test})`, function () { - parse(test) + suite.add(`invalid parse(${test[0]})`, function () { + parse(test[0]) }) } diff --git a/classes/semver.js b/classes/semver.js index 2efba0f4..92254be1 100644 --- a/classes/semver.js +++ b/classes/semver.js @@ -111,11 +111,25 @@ class SemVer { other = new SemVer(other, this.options) } - return ( - compareIdentifiers(this.major, other.major) || - compareIdentifiers(this.minor, other.minor) || - compareIdentifiers(this.patch, other.patch) - ) + if (this.major < other.major) { + return -1 + } + if (this.major > other.major) { + return 1 + } + if (this.minor < other.minor) { + return -1 + } + if (this.minor > other.minor) { + return 1 + } + if (this.patch < other.patch) { + return -1 + } + if (this.patch > other.patch) { + return 1 + } + return 0 } comparePre (other) { diff --git a/internal/identifiers.js b/internal/identifiers.js index a4613dee..d053472d 100644 --- a/internal/identifiers.js +++ b/internal/identifiers.js @@ -2,6 +2,10 @@ const numeric = /^[0-9]+$/ const compareIdentifiers = (a, b) => { + if (typeof a === 'number' && typeof b === 'number') { + return a === b ? 0 : a < b ? -1 : 1 + } + const anum = numeric.test(a) const bnum = numeric.test(b) diff --git a/test/internal/identifiers.js b/test/internal/identifiers.js index 1a89583e..cb217eda 100644 --- a/test/internal/identifiers.js +++ b/test/internal/identifiers.js @@ -8,6 +8,7 @@ test('rcompareIdentifiers and compareIdentifiers', (t) => { ['1', '2'], ['alpha', 'beta'], ['0', 'beta'], + [1, 2], ] set.forEach((ab) => { const a = ab[0] @@ -17,5 +18,7 @@ test('rcompareIdentifiers and compareIdentifiers', (t) => { }) t.equal(compareIdentifiers('0', '0'), 0) t.equal(rcompareIdentifiers('0', '0'), 0) + t.equal(compareIdentifiers(1, 1), 0) + t.equal(rcompareIdentifiers(1, 1), 0) t.end() }) From a25789b09b1192fa8414c35f2cd679ae2e1d5192 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 7 Oct 2025 10:26:26 -0700 Subject: [PATCH 6/6] chore: release 7.7.3 (#812) :robot: I have created a release *beep* *boop* --- ## [7.7.3](https://github.com/npm/node-semver/compare/v7.7.2...v7.7.3) (2025-10-06) ### Bug Fixes * [`e37e0ca`](https://github.com/npm/node-semver/commit/e37e0ca0b5fc910d2b1948d25dbc83cc3a0921ea) [#813](https://github.com/npm/node-semver/pull/813) faster paths for compare (#813) (@H4ad) * [`2471d75`](https://github.com/npm/node-semver/commit/2471d7543e2e63d9d95358e2405e7e1cde926c36) [#811](https://github.com/npm/node-semver/pull/811) x-range build metadata support (i529015) ### Chores * [`8f05c87`](https://github.com/npm/node-semver/commit/8f05c87f56a4123259b8c6d9324f53eadb02e48f) [#807](https://github.com/npm/node-semver/pull/807) bump @npmcli/template-oss from 4.25.0 to 4.25.1 (#807) (@dependabot[bot], @owlstronaut) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .release-please-manifest.json | 2 +- CHANGELOG.md | 7 +++++++ package.json | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index 3066f524..32a56fe9 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "7.7.2" + ".": "7.7.3" } diff --git a/CHANGELOG.md b/CHANGELOG.md index 90d1cd1e..518b61bc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [7.7.3](https://github.com/npm/node-semver/compare/v7.7.2...v7.7.3) (2025-10-06) +### Bug Fixes +* [`e37e0ca`](https://github.com/npm/node-semver/commit/e37e0ca0b5fc910d2b1948d25dbc83cc3a0921ea) [#813](https://github.com/npm/node-semver/pull/813) faster paths for compare (#813) (@H4ad) +* [`2471d75`](https://github.com/npm/node-semver/commit/2471d7543e2e63d9d95358e2405e7e1cde926c36) [#811](https://github.com/npm/node-semver/pull/811) x-range build metadata support (i529015) +### Chores +* [`8f05c87`](https://github.com/npm/node-semver/commit/8f05c87f56a4123259b8c6d9324f53eadb02e48f) [#807](https://github.com/npm/node-semver/pull/807) bump @npmcli/template-oss from 4.25.0 to 4.25.1 (#807) (@dependabot[bot], @owlstronaut) + ## [7.7.2](https://github.com/npm/node-semver/compare/v7.7.1...v7.7.2) (2025-05-12) ### Bug Fixes * [`fcafb61`](https://github.com/npm/node-semver/commit/fcafb61ed566ff8ccf24818dd94b76738f037aa4) [#780](https://github.com/npm/node-semver/pull/780) add missing `'use strict'` directives (#780) (@Fdawgs) diff --git a/package.json b/package.json index 72d476bb..2b8cadaa 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "semver", - "version": "7.7.2", + "version": "7.7.3", "description": "The semantic version parser used by npm.", "main": "index.js", "scripts": {