Masterminds / semver

Work with Semantic Versions in Go

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

`20221209-update-renovatejson-v4` tag does not fail NewVersion test

bcbrockway opened this issue · comments

Hi all, our ArgoCD Image Updater randomly changed one of our prod tags from v1.10.0 to a branch image - 20221209-update-renovatejson-v4. They use the NewVersion function (here) and we should probably petition them to add an option to use StrictNewVersion but should NewVersion really be accepting that tag as a valid semver?

@bcbrockway it looks like you found a bug.

It turns out I was wrong. From the spec:

Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]

If you read the grammar you'll find the - explicitly listed for the <non-digit> cases.

A - is allowed. So, NewVersion should parse 20221209-update-renovatejson-v4 as valid while StrictNewVersion should provide an error.