test: pin semver build-metadata precedence and exercise the real versionMatchesRange path

tests/helpers.test.ts

@@ -351,6 +351,12 @@ describe("version helpers", () => {
     expect(compareVersions("1.2.3-beta", "1.2.3-alpha")).toBeGreaterThan(0);
   });
 
+  it("ignores build metadata when comparing versions (semver 10)", () => {
+    // Build metadata carries no precedence: equal to the bare release.
+    expect(compareVersions("1.2.3+build", "1.2.3")).toBe(0);
+    expect(compareVersions("1.2.3-beta+a", "1.2.3-beta+b")).toBe(0);
+  });
+
   it("ranks a pre-release below its associated release (semver 11.3)", () => {
     expect(compareVersions("1.2.3-beta.1", "1.2.3")).toBeLessThan(0);
     expect(compareVersions("1.2.3", "1.2.3-beta.1")).toBeGreaterThan(0);

tests/local-advisory-source.test.ts

@@ -128,6 +128,27 @@ describe("LocalAdvisorySource", () => {
       cleanupDbPath(dbPath);
     }
   });
+  it("flags a pre-release below the fix via the real versionMatchesRange path (issue #1087)", async () => {
+    const dbPath = createTempDbPath();
+    const db = new LocalAdvisoryDatabase(dbPath);
+    const source = new LocalAdvisorySource(db);
+
+    try {
+      seedVulnerability(db); // lodash fixed at 4.17.21
+
+      // 4.17.21-beta.1 sorts below 4.17.21, so it is still inside the affected range.
+      const results = await source.queryBatch([
+        createPackage("lodash", "4.17.21-beta.1"),
+        createPackage("lodash", "4.17.21"),
+      ]);
+
+      expect(results[0]?.vulnerabilities).toEqual([{ id: "OSV-2026-LOCAL-1" }]);
+      expect(results[1]?.vulnerabilities).toEqual([]);
+    } finally {
+      db.close();
+      cleanupDbPath(dbPath);
+    }
+  });
 
   it("returns stored vulnerability documents by id", async () => {
     const dbPath = createTempDbPath();