Visitar URL original
fix: reject non-semver candidate versions in isVersionSatisfies (#1009) · actions/setup-java@baa1691 · GitHub
Skip to content

Commit baa1691

Browse files
sproctorclaude
sproctor
and
claude
authored
fix: reject non-semver candidate versions in isVersionSatisfies (#1009)
Distributions like JetBrains Runtime publish 4-segment versions such as '17.0.8.1+1080.1' that the semver package rejects. Both compareBuild and satisfies throw on these, which surfaced to users as "Error: Invalid Version: 17.0.8.1+1080.1" and aborted the whole install when any available version was non-semver. Guard with an early semver.valid check so unparseable versions are treated as a non-match. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent bc52a13 commit baa1691

4 files changed

Lines changed: 27 additions & 1 deletion

File tree

‎__tests__/util.test.ts‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,11 @@ describe('isVersionSatisfies', () => {
2929
['2.5.1+3', '2.5.1+3', true],
3030
['2.5.1+3', '2.5.1+2', false],
3131
['15.0.0+14', '15.0.0+14.1.202003190635', false],
32-
['15.0.0+14.1.202003190635', '15.0.0+14.1.202003190635', true]
32+
['15.0.0+14.1.202003190635', '15.0.0+14.1.202003190635', true],
33+
// 4-segment versions (e.g. JetBrains Runtime '17.0.8.1+1080.1') are not
34+
// valid semver — they should be rejected, not throw.
35+
['25.0.3+480.61', '17.0.8.1+1080.1', false],
36+
['17', '17.0.8.1+1080.1', false]
3337
])(
3438
'%s, %s -> %s',
3539
(inputRange: string, inputVersion: string, expected: boolean) => {

‎dist/cleanup/index.js‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52208,6 +52208,13 @@ function getDownloadArchiveExtension() {
5220852208
exports.getDownloadArchiveExtension = getDownloadArchiveExtension;
5220952209
function isVersionSatisfies(range, version) {
5221052210
var _a;
52211+
// Some distributions (e.g. JetBrains Runtime) publish 4-segment versions
52212+
// like '17.0.8.1+1080.1' that semver rejects. If the candidate version
52213+
// isn't valid semver, it can't match — bail out rather than letting
52214+
// compareBuild / satisfies throw.
52215+
if (!semver.valid(version)) {
52216+
return false;
52217+
}
5221152218
if (semver.valid(range)) {
5221252219
// if full version with build digit is provided as a range (such as '1.2.3+4')
5221352220
// we should check for exact equal via compareBuild

‎dist/setup/index.js‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81039,6 +81039,13 @@ function getDownloadArchiveExtension() {
8103981039
exports.getDownloadArchiveExtension = getDownloadArchiveExtension;
8104081040
function isVersionSatisfies(range, version) {
8104181041
var _a;
81042+
// Some distributions (e.g. JetBrains Runtime) publish 4-segment versions
81043+
// like '17.0.8.1+1080.1' that semver rejects. If the candidate version
81044+
// isn't valid semver, it can't match — bail out rather than letting
81045+
// compareBuild / satisfies throw.
81046+
if (!semver.valid(version)) {
81047+
return false;
81048+
}
8104281049
if (semver.valid(range)) {
8104381050
// if full version with build digit is provided as a range (such as '1.2.3+4')
8104481051
// we should check for exact equal via compareBuild

‎src/util.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,14 @@ export function getDownloadArchiveExtension() {
5555
}
5656

5757
export function isVersionSatisfies(range: string, version: string): boolean {
58+
// Some distributions (e.g. JetBrains Runtime) publish 4-segment versions
59+
// like '17.0.8.1+1080.1' that semver rejects. If the candidate version
60+
// isn't valid semver, it can't match — bail out rather than letting
61+
// compareBuild / satisfies throw.
62+
if (!semver.valid(version)) {
63+
return false;
64+
}
65+
5866
if (semver.valid(range)) {
5967
// if full version with build digit is provided as a range (such as '1.2.3+4')
6068
// we should check for exact equal via compareBuild

0 commit comments

Comments
 (0)