Skip to content

fix: reject numeric segments after x-ranges in tilde and caret ranges - #931

Open
Enesuygurs wants to merge 1 commit into
npm:mainfrom
Enesuygurs:fix/reject-x-range-order-in-tilde-caret
Open

Enesuygurs wants to merge 1 commit into
npm:mainfrom
Enesuygurs:fix/reject-x-range-order-in-tilde-caret

Conversation

@Enesuygurs

Copy link
Copy Markdown

e583226 made x-ranges with a number after a wildcard invalid, so 1.x.5, x.1 and x.1.2 now throw. That check only runs in replaceXRange. The same input behind ~ or ^ is still accepted, and the trailing numbers are silently dropped:

new Range('x.1.2')           // throws Invalid comparator
new Range('^x.1.2').range    // '' (same as '*')
validRange('^x.1.2')         // '*'
satisfies('0.0.1', '^x.1.2') // true
new Range('~1.x.5').range    // '>=1.0.0 <2.0.0-0'

^x.1.2 turning into * is the worst case: a mistyped range validates and matches every version.

This PR calls the existing invalidXRangeOrder() check from replaceTilde and replaceCaret as well, so these ranges are rejected the same way the bare x-range is. In loose mode the invalid token is dropped, which matches the existing 1.x.5 || 2.x loose fixture.

Tests: I added rows to test/fixtures/range-parse.js for ~1.x.5, ~>1.*.5, ~x.1, ^1.x.5, ^1.X.5-beta and ^x.1.2. They run under all four option combinations and also feed test/ranges/valid.js. I updated the fixture row counts in test/classes/range.js to match. The full suite passes with 100% coverage, and npm run lint passes.

@Enesuygurs
Enesuygurs requested a review from a team as a code owner October 23, 2026 12:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant