Bug: arcup SemVer comparison treats prerelease and stable versions as equal #205

Activity

1. osr21 commented on Jul 18, 2026

   

   osr21

   on Jul 18, 2026

   More actions

   The analysis is correct. Here is a tested drop-in replacement for version_gt that covers all the cases in the issue.

   Replacement version_gt

   # Compare SemVer versions per semver.org 2.0.0
   # Returns 0 if $1 > $2, 1 otherwise (equal or less)
   version_gt() {
     local ver1="${1#v}" ver2="${2#v}"
   
     # Split core (major.minor.patch) and prerelease
     local core1="${ver1%%-*}" pre1=""
     local core2="${ver2%%-*}" pre2=""
     [[ "$ver1" == *-* ]] && pre1="${ver1#*-}"
     [[ "$ver2" == *-* ]] && pre2="${ver2#*-}"
   
     IFS='.' read -r maj1 min1 pat1 <<< "$core1"
     IFS='.' read -r maj2 min2 pat2 <<< "$core2"
   
     # Compare numeric core fields
     if   (( maj1 != maj2 )); then (( maj1 > maj2 )) && return 0 || return 1
     elif (( min1 != min2 )); then (( min1 > min2 )) && return 0 || return 1
     elif (( pat1 != pat2 )); then (( pat1 > pat2 )) && return 0 || return 1
     fi
   
     # Cores are equal — prerelease precedence per §11
     [[ -z "$pre1" && -n "$pre2" ]] && return 0   # stable > any pre
     [[ -n "$pre1" && -z "$pre2" ]] && return 1   # pre < stable
     [[ -z "$pre1" && -z "$pre2" ]] && return 1   # equal
   
     # Both have prereleases — compare dot-separated identifiers per §11.4
     IFS='.' read -ra ids1 <<< "$pre1"
     IFS='.' read -ra ids2 <<< "$pre2"
     local n1=${#ids1[@]} n2=${#ids2[@]}
     local len=$(( n1 < n2 ? n1 : n2 ))
   
     for (( i=0; i<len; i++ )); do
       local a="${ids1[$i]}" b="${ids2[$i]}"
       if [[ "$a" =~ ^[0-9]+$ && "$b" =~ ^[0-9]+$ ]]; then
         (( a != b )) && { (( a > b )) && return 0 || return 1; }
       elif [[ "$a" =~ ^[0-9]+$ ]]; then
         return 1   # numeric < alphanumeric per §11.4.1.3
       elif [[ "$b" =~ ^[0-9]+$ ]]; then
         return 0   # alphanumeric > numeric
       else
         [[ "$a" != "$b" ]] && { [[ "$a" > "$b" ]] && return 0 || return 1; }
       fi
     done
   
     # All shared fields equal; more fields = greater per §11.4.4
     (( n1 > n2 )) && return 0
     (( n1 < n2 )) && return 1
     return 1
   }

   Test results

   All cases from the issue, plus additional edge cases, verified locally:

   # Reporter's expected-true cases
   version_gt "1.0.0"          "1.0.0-rc.1"    → PASS (true)
   version_gt "1.0.0-rc.2"     "1.0.0-rc.1"    → PASS (true)
   version_gt "1.0.0-beta.11"  "1.0.0-beta.2"  → PASS (true, numeric not lex)
   version_gt "1.0.1"          "1.0.0"         → PASS (true)
   version_gt "2.0.0"          "1.99.99"       → PASS (true)
   version_gt "0.3.0"          "0.3.0-rc.1"    → PASS (true)
   
   # Reporter's expected-false cases
   version_gt "1.0.0-rc.1"     "1.0.0"         → PASS (false)
   version_gt "1.0.0-rc.1"     "1.0.0-rc.2"    → PASS (false)
   version_gt "1.0.0"          "1.0.0"         → PASS (false)
   
   # Additional edge cases
   version_gt "1.0.0-alpha.1"  "1.0.0-alpha"   → PASS (true, more fields > fewer)
   version_gt "1.0.0-rc.1"     "1.0.0-beta.11" → PASS (true, "rc" > "beta" lexically)
   version_gt "1.0.0-alpha"    "1.0.0-1"       → PASS (true, alphanumeric > numeric)
   version_gt "1.0.0-1"        "1.0.0-alpha"   → PASS (false, numeric < alphanumeric)
   version_gt "v1.0.0"         "v0.9.9"        → PASS (true, v-prefix stripped)
   version_gt "1.0.0-rc.1"     "1.0.0-rc.1"   → PASS (false, identical prerelease)
   version_gt "1.0.0-beta.2"   "1.0.0-beta.11" → PASS (false, 2 < 11 numerically)
   

   Notes

   No external dependencies. sort -V (GNU coreutils version sort) handles this on Linux but is absent on macOS (BSD sort has no -V). Since arcup targets both platforms, pure bash is the right approach.

   Bash requirement. The replacement uses [[ ]], (( )), =~, and <<< — all bash-specific. The existing script already requires bash (e.g. line 294 uses [[ ! "$version" =~ ^v[0-9]+... ]]), so this is not a regression from the current POSIX-style IFS=. read <<EOF here-document pattern.

   check_installer_up_to_date and update_arcup (lines 423 and 452) both call version_gt without changes — the replacement is a drop-in.

   SemVer §11 reference: https://semver.org/#spec-item-11

   👍React with 👍1Reacted by health_coach
2. danilaverbena

   added a commit that references this issue on Jul 20, 2026

   fix(arcup): honor SemVer prerelease precedence in version_gt

   ...

   This issue will close once commit 8d3863b is merged into the 'main' branch.

   8d3863b
3. ZhiyuCircle

   added

   bugSomething isn't workingSomething isn't working

   opsComponent: opsComponent: ops

   on Jul 23, 2026
4. danilaverbena

   added a commit that references this issue on Jul 26, 2026

   test(arcup): add version_gt SemVer precedence test suite

   ...

   cf76b1c
5. JspIIV

   added a commit that references this issue on Sep 13, 2026

   Order pre-releases of the same version by their identifiers

   ...

   a5f54b8
6. JspIIV commented on Sep 15, 2026

   

   JspIIV

   on Sep 15, 2026

   More actions

   Requesting assignment per the new contribution policy. #300 addresses this: keeps the pre-release tags instead of stripping them, orders two pre-releases per SemVer §11.4, strips build metadata first, and bumps ARCUP_INSTALLER_VERSION so self-update can deliver it. Tests walk the semver.org §11.4 chain and all fail on main.