python-semanticversion icon indicating copy to clipboard operation
python-semanticversion copied to clipboard

Incomplete support for NpmSpec, according to node-semver

Open gnattishness opened this issue 3 years ago • 4 comments

python-semanticversion currently appears to support "canonical" NPM version specs, as according to their range.bnf, but the node-semver implementation also accepts a superset of that syntax as valid. For example, the implementation allows spaces between the prefix and the version (> 1.2.3), or additional whitespace within a hyphen-range (0.1.2 - 3.4.5). It also has a ~> prefix, which appears to be equivalent to ~.

The NpmSpec does not accept these as valid, and raises a ValueError.

I believe that NpmSpec should aim to be equivalent to the node-semver implementation, correctly parsing anything NPM accepts as valid.

Note also the related issue npm/node-semver#392, which goes into more detail about the discrepancy between the syntax definition and the implementation.

gnattishness avatar Jul 10 '21 06:07 gnattishness

(Note: this extra syntax is all accepted as valid by npm even in strict parsing mode ("loose": false))

gnattishness avatar Jul 10 '21 07:07 gnattishness

Thanks for the bug report, and the investigation!

I'd like to wait until one position is taken on npm/node-semver#392 to adjust here accordingly.

rbarrois avatar Jul 15 '21 12:07 rbarrois

My 2 cents: accepting more and matching node-semver's code with winks, quirks, features and bugs would be my preferred approach

pombredanne avatar May 18 '22 08:05 pombredanne

@pombredanne This approach would resolve the downstream bug I encountered (where the project accepts "npm style" versions, and the python implementation will sometimes reject version strings that are accepted elsewhere) This would be similarly encountered by a python project that's needing to parse npm package.lock files.

But I appreciate trying to match some "reference implementation" is often much more troublesome than a well-defined spec, particularly if it's not communicated clearly whether those quirks are internal implementation details or not.

gnattishness avatar May 19 '22 10:05 gnattishness