From 1da8c1749612e6c320d60f8bcc763776bfe98032 Mon Sep 17 00:00:00 2001 From: Retsumdk Date: Sat, 5 Sep 2026 21:36:51 +0000 Subject: [PATCH 1/2] test: pin semver build-metadata precedence and the real versionMatchesRange path Coverage for issue #1087: 1. Build metadata carries no precedence in semver (10): a version with a '+build' suffix is equal to the bare release, for both string and pre-release-carrying inputs. Nothing previously asserted this. 2. The existing hand-copied test only proved compareVersions, not the scanner path it is named after. Add an end-to-end test that seeds a lodash advisory fixed at 4.17.21 and asserts a pre-release below that fix (4.17.21-beta.1) is flagged while the fixed release is not, exercising the real versionMatchesRange in src/advisory/local-db.ts. Test-only change; no behavior in src altered. --- tests/helpers.test.ts | 10 ++++++++++ tests/local-advisory-source.test.ts | 21 +++++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/tests/helpers.test.ts b/tests/helpers.test.ts index cd0849e8..80520e43 100644 --- a/tests/helpers.test.ts +++ b/tests/helpers.test.ts @@ -351,6 +351,16 @@ describe("version helpers", () => { expect(compareVersions("1.2.3-beta", "1.2.3-alpha")).toBeGreaterThan(0); }); + it("ranks a pre-release below its associated release (semver 11.3)", () => { expect(compareVersions("1.2.3", "1.2.3")).toBe(0); + expect(compareVersions("1.2.3-beta", "1.2.3-alpha")).toBeGreaterThan(0); + }); + + it("ignores build metadata when comparing versions (semver 10)", () => { + // Build metadata carries no precedence: equal to the bare release. + expect(compareVersions("1.2.3+build", "1.2.3")).toBe(0); + expect(compareVersions("1.2.3-beta+a", "1.2.3-beta+b")).toBe(0); + }); + it("ranks a pre-release below its associated release (semver 11.3)", () => { expect(compareVersions("1.2.3-beta.1", "1.2.3")).toBeLessThan(0); expect(compareVersions("1.2.3", "1.2.3-beta.1")).toBeGreaterThan(0); diff --git a/tests/local-advisory-source.test.ts b/tests/local-advisory-source.test.ts index 37affbc4..eb254f51 100644 --- a/tests/local-advisory-source.test.ts +++ b/tests/local-advisory-source.test.ts @@ -128,6 +128,27 @@ describe("LocalAdvisorySource", () => { cleanupDbPath(dbPath); } }); + it("flags a pre-release below the fix via the real versionMatchesRange path (issue #1087)", async () => { + const dbPath = createTempDbPath(); + const db = new LocalAdvisoryDatabase(dbPath); + const source = new LocalAdvisorySource(db); + + try { + seedVulnerability(db); // lodash fixed at 4.17.21 + + // 4.17.21-beta.1 sorts below 4.17.21, so it is still inside the affected range. + const results = await source.queryBatch([ + createPackage("lodash", "4.17.21-beta.1"), + createPackage("lodash", "4.17.21"), + ]); + + expect(results[0]?.vulnerabilities).toEqual([{ id: "OSV-2026-LOCAL-1" }]); + expect(results[1]?.vulnerabilities).toEqual([]); + } finally { + db.close(); + cleanupDbPath(dbPath); + } + }); it("returns stored vulnerability documents by id", async () => { const dbPath = createTempDbPath(); From fec80f2e12e0e863861255127d9f0127db4830d1 Mon Sep 17 00:00:00 2001 From: Retsumdk Date: Mon, 7 Sep 2026 16:04:34 +0000 Subject: [PATCH 2/2] test: remove duplicated pre-release ranking test name/body The previous commit for #1087 included a 3-line paste that duplicated the name of the real pre-release ranking test and copied the body of the numeric-comparison test above it. The reviewer flagged it; the real test (semver 11.3) and its assertions are already present unchanged below. Removes a dead duplicate, leaves all real coverage intact. No behavior change. Co-authored-by: Charles Lionel Tia-Bia --- tests/helpers.test.ts | 4 ---- 1 file changed, 4 deletions(-) diff --git a/tests/helpers.test.ts b/tests/helpers.test.ts index 80520e43..245b91a3 100644 --- a/tests/helpers.test.ts +++ b/tests/helpers.test.ts @@ -351,10 +351,6 @@ describe("version helpers", () => { expect(compareVersions("1.2.3-beta", "1.2.3-alpha")).toBeGreaterThan(0); }); - it("ranks a pre-release below its associated release (semver 11.3)", () => { expect(compareVersions("1.2.3", "1.2.3")).toBe(0); - expect(compareVersions("1.2.3-beta", "1.2.3-alpha")).toBeGreaterThan(0); - }); - it("ignores build metadata when comparing versions (semver 10)", () => { // Build metadata carries no precedence: equal to the bare release. expect(compareVersions("1.2.3+build", "1.2.3")).toBe(0);