package:pub_semver: int.tryParse without radix allows hex and negative prerelease/build identifiers #2488

In pub_semver, _splitParts segments pre-release and build strings using int.tryParse(part) ?? part:

https://github.com/dart-lang/tools/blob/main/pkgs/pub_semver/lib/src/version.dart#L161-L167

Because int.tryParse(part) is called without specifying radix: 10, Dart's parser accepts hexadecimal literals (e.g. 0xA) and leading signs (e.g. -1). This converts what should be alphanumeric identifiers into integers.

Per the SemVer 2.0.0 specification (§9, §11.4, and the BNF grammar):

• Numeric identifiers must consist only of ASCII digits 0-9 (base 10) without leading zeros.
• Identifiers containing letters or hyphens (like 0xA or -1) are alphanumeric identifiers, not numeric identifiers, and must be compared lexically in ASCII sort order.
• Numeric identifiers always have lower precedence than alphanumeric identifiers.

Consequences

1. Equality aliasing:
   Version.parse('1.0.0-0xA') == Version.parse('1.0.0-10') evaluates to true because both store preRelease: [10]. In SemVer, 0xA is an alphanumeric identifier and 10 is numeric; they are distinct, and 1.0.0-10 < 1.0.0-0xA.

2. Constraint boundary bypass:
   In 2.0.0--1, the pre-release identifier is "-1", which gets parsed as the integer -1. When evaluating 2.0.0--1 against ^1.0.0 (which has an exclusive upper bound of 2.0.0-0), pub_semver compares -1.compareTo(0) -> -1, concluding 2.0.0--1 < 2.0.0-0 and allowing 2.0.0--1 to satisfy ^1.0.0. Under SemVer 2.0, 0 < "-1" (numeric < non-numeric), so 2.0.0-0 < 2.0.0--1.

3. Build metadata aliasing:
   Version.parse('1.0.0+0xFF') == Version.parse('1.0.0+255') evaluates to true.

Suggested Fix

Ensure only pure-digit segments (^\d+$) are converted to integers using base-10 radix, treating all other segments as strings.