Fix version handling for non-semver and prerelease versions#8
Merged
christian-andersson merged 4 commits intoApr 13, 2026
Merged
Conversation
Fix several version classification and comparison issues that produced
wrong "latest" results for real-world packages:
- isPrerelease now recognizes stable variant tags (jre, jre7, android,
android7, incubating, RELEASE, Final, GA, SR\d+) and OSGi-style
timestamped releases (e.g. jgit's 7.6.0.202603022253-r). These were
previously misclassified as prereleases.
- parseVersion now handles Maven 4-part dot-style qualifiers with
letter OR digit start (1.0.0.RELEASE, 2.0.0.M4, 2.9.9.20190807,
7.6.0.202603022253-r) so they sort correctly via semver rules.
- compareVersions now prefers parseable versions over non-parseable
ones. Without this, legacy tags like Guava's "r09" sorted lexically
above modern "33.5.0-jre" ("r" > "3").
- New resolveLatestVersions helper centralizes the stable/prerelease
resolution across registries. When includePrerelease is true and no
stable exists in the filtered set, it falls back to the latest
prerelease (fixes Spring AI 2.0.0-M4 case where stable hasn't
shipped yet in the 2.x line).
When a dependency's current version is itself a prerelease (e.g. 2.0.0-M4, 1.0.0-RC1), automatically restrict the lookup to the same major version including prereleases. Avoids suggesting "downgrades" from a prerelease line to an older stable (e.g. spring-ai-bom 2.0.0-M4 being told to downgrade to 1.1.4). Also extend lookup_version and analyze_dependencies descriptions so Claude knows when to set includePrerelease + versionPrefix, and documents which variant tags (jre, RELEASE, Final, GA, SR) are stable.
christian-andersson
deleted the
fix-non-semver-and-prerelease-version-handling
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix several real-world version classification failures that produced wrong
"latest" results:
2.0.0-M4—analyze_dependenciesnow auto-detects prereleaselines and restricts lookups to the same major (with
includePrerelease),so it won't suggest downgrading to
1.1.4.33.5.0-jre— legacyr09/r07/r08tags no longer sort abovemodern
-jreversions (compareVersionsprefers parseable overnon-parseable).
jre\d*andandroid\d*are now treated as stable variants.42.7.10—9.4.1212.jre7no longer sorts above42.7.10(Maven 4-part regex now accepts digit-start qualifiers andjre7/jre8are stable variants).7.6.0.202603022253-r— OSGi timestamped release qualifiers(
\d{6,}-r) are now classified as stable and parseable.2.9.9.20190807— Maven 4-part numericqualifiers now parse correctly, so
2.21.0>2.9.9.20190807(previouslylocaleCompareput2.9>2.21).Implementation:
isPrereleaseallowlist extended:jre\d*,android\d*,\d{6,}-rparseVersionMaven 4-part regex accepts letter OR digit qualifier startcompareVersionsprefers parseable versions over non-parseableresolveLatestVersionshelper centralizes stable/prerelease resolution(with prerelease fallback when no stable exists in filtered set)
analyze_dependenciesauto-detects prerelease current versions and appliesincludePrerelease: true+versionPrefix: "<major>."Test plan
deno fmt --checkpassesdeno lintpassesdeno check main.tspassesdeno test --allow-net— 176/176 tests pass (29 new edge-case tests)analyze_dependencieson a pom.xml withspring-ai-bom:2.0.0-M4should suggest updates within 2.x, not downgrade to 1.1.4
lookup_versionforcom.google.guava:guavashould return a-jreversion, notr09lookup_versionfororg.postgresql:postgresqlshould return42.7.x, not9.4.1212.jre7🤖 Generated with Claude Code