Version comparison bug: 0.10.0.1 incorrectly compared as less than 0.9.0.1

[db-lyon]

Describe the bug

When promoting a package version and creating a GitHub release, CumulusCI incorrectly compares version numbers when one version has a double-digit component. For example, version 0.10.0.1 is being treated as less than 0.9.0.1 due to string-based comparison of version components.

• Version 0.10.0.1 should be correctly recognized as newer than 0.9.0.1

• System treats 0.10.0.1 as older than 0.9.0.1 due to string-based comparison

Reproduction steps

Steps to reproduce:

1. Have a package with version 0.10.0.1 in beta
2. Try to promote it using cci task run promote_package_version
3. The system attempts to create a release but fails because it thinks 0.9.0.1 is newer than 0.10.0.1

Your CumulusCI and Python versions

CCI: 3.90.0 PY: 3.10.16

Operating System

Windows, Github Actions, Mac

Windows environment

PowerShell

CumulusCI installation method

pip

Error Gist

No response

Additional information

While the error occurs in github_release, I believe the issue stems from the PromotePackageVersion class. It uses Python's LooseVersion class from distutils.version (copied into cumulusci/utils/version_strings.py), which does string-based comparisons of version components.

When comparing 0.10.0.1 and 0.9.0.1, the comparison is happening on the string level, where "9" is lexicographically greater than "10" because the comparison starts with "9" vs "1".

Here's the portion of code I believe to be relevant:

class LooseVersion(Version):
    component_re = re.compile(r"(\d+ | [a-z]+ | \.)", re.VERBOSE)

    def parse(self, vstring):
        self.vstring = vstring
        components = [x for x in self.component_re.split(vstring) if x and x != "."]
        for i, obj in enumerate(components):
            try:
                components[i] = int(obj)
            except ValueError:
                pass
        self.version = components