Skip to content

[pub_semver] Parse only pure-digit prerelease/build identifiers as integers - #2489

Merged
sigurdm merged 3 commits into
dart-lang:mainfrom
sigurdm:fix_semver_parse
Aug 10, 2026
Merged

sigurdm merged 3 commits into
dart-lang:mainfrom
sigurdm:fix_semver_parse

Conversation

@sigurdm

@sigurdm sigurdm commented Aug 3, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #2488

In pub_semver, _splitParts segmented pre-release and build strings using int.tryParse(part) ?? part. Because int.tryParse accepts hexadecimal literals (e.g. 0xA) and leading signs (e.g. -1), alphanumeric identifiers were incorrectly converted to integers.

Under SemVer 2.0.0, identifiers containing letters or hyphens are alphanumeric and must be compared lexically in ASCII sort order, with numeric identifiers having lower precedence.

This PR updates _splitParts to only convert segments consisting purely of ASCII digits (^\d+$) to integers, leaving other identifiers as strings.

This is changing behavior, but only in a bug-fixing manner, i propose publishing this as a patch-release.

@sigurdm
sigurdm requested a review from a team as a code owner August 3, 2026 13:47

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request fixes the parsing of pre-release and build identifiers in pub_semver to ensure that only pure-digit base-10 identifiers are treated as integers, while hexadecimal and signed identifiers are treated as alphanumeric strings in accordance with SemVer 2.0.0. This is achieved by introducing a regular expression _digitsPattern to validate numeric parts before parsing them. Corresponding tests have been added to verify this behavior. There are no review comments, so I have no feedback to provide.

@sigurdm
sigurdm requested review from mosuem and szakarias August 3, 2026 13:57
@sigurdm
sigurdm requested a review from jakemac53 August 4, 2026 12:36
@sigurdm
sigurdm merged commit d644cda into dart-lang:main Aug 10, 2026
22 checks passed
copybara-service Bot pushed a commit to dart-lang/sdk that referenced this pull request Aug 11, 2026
Revisions updated by `dart tools/rev_sdk_deps.dart`.

dartdoc (https://github.com/dart-lang/dartdoc/compare/1fd02f7..8be851e):
  8be851e2  Mon Aug 10 13:51:08 2026 +0200  Sarah Zakarias  Bump to 9.0.9 (dart-lang/dartdoc#4278)

http (https://github.com/dart-lang/http/compare/9cb80c7..a9176ac):
  a9176ac  Mon Aug 10 13:27:26 2026 +0200  dart-ecosystem-bot[bot]  Tidy: package:http2 (dart-lang/http#1967)
  9bd9ccb  Sat Aug 8 06:31:37 2026 +0300  Ellet  chore(ok_http): migrate to jni 1.0.0 (dart-lang/http#1943)
  107e4c7  Sat Aug 8 04:54:46 2026 +0300  Yauhen Sampir  [cronet_http] Add DNS configuration options to CronetEngine.build (dart-lang/http#1945)
  55c39c9  Sat Aug 8 07:57:20 2026 +0800  Seven Du  Fix RFC 850 two-digit year parsing (dart-lang/http#1951)
  c71cb6d  Sat Aug 8 01:47:35 2026 +0200  Moritz  Add ecosystem groundskeeper workflow (dart-lang/http#1959)

test (https://github.com/dart-lang/test/compare/dd426d4..55b186d):
  55b186dd  Mon Aug 10 22:18:01 2026 +0200  Sigurd Meldgaard  Fix race conditions in Chrome coverage collection (dart-lang/test#2715)
  51463b0e  Mon Aug 10 21:59:15 2026 +0300  Yusuf İhsan Görgel  Keep the browser executable env override through a settings merge (dart-lang/test#2722)
  b87a2492  Fri Aug 7 12:07:52 2026 -0700  Jacob MacDonald  Enable asserts (dart-lang/test#2719)

tools (https://github.com/dart-lang/tools/compare/f3ec9ed..d644cda):
  d644cdab  Mon Aug 10 11:24:43 2026 +0200  Sigurd Meldgaard  [pub_semver] Parse only pure-digit prerelease/build identifiers as integers (dart-lang/tools#2489)
  df06fed9  Fri Aug 7 15:37:45 2026 -0700  Nate Bosch  Update to Dart 3.10.0 and reformat (dart-lang/tools#2502)
  aec21dae  Fri Aug 7 14:23:11 2026 -0700  Nate Bosch  [code_builder] Minor style fixes (dart-lang/tools#2501)
  1bbcc309  Fri Aug 7 13:56:38 2026 -0700  Nate Bosch  Revert "[code_builder] Add control-flow support (`#2135`)" (dart-lang/tools#2499)
  77607740  Fri Aug 7 01:59:58 2026 +0530  Aman Maurya  Fix MultiChannel inner channel type constraint documentation (dart-lang/tools#2491)
  889787a8  Thu Aug 6 12:56:22 2026 -0700  Nate Bosch  Roll to the latest package:csv (dart-lang/tools#2497)

[email protected]

Change-Id: I4cb9a8839c9ae21c57eca7750c81fdbd1a58a09c
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/534341
Auto-Submit: Nate Bosch <[email protected]>
Reviewed-by: Kevin Moore <[email protected]>
Commit-Queue: Kevin Moore <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

package:pub_semver: int.tryParse without radix allows hex and negative prerelease/build identifiers

3 participants