fix(semver): parser accepts invalid SemVer 2.0 values + crashes on leading-zero patch (octal interpretation) #329

New issue

Closed

opened 2026-07-03 13:35:59 +02:00 by bosun · 0 comments

bosun commented

2026-07-03 13:35:59 +02:00

Owner

Empirical failure

scripts/lib/semver.sh claims SemVer 2.0.0 compliance but the regex at line 27 accepts these invalid values then crashes on bump:

01.2.3, 1.02.3, 1.2.03 — leading zeros
1.2.3-alpha..1 — empty identifier
1.2.3-01 — numeric prerelease with leading zero
1.2.3-.alpha, 1.2.3-alpha. — leading/trailing dot
1.2.3+build..1 — empty build id

Then crashes: semver_bump patch 1.2.08 → 08: value too great for base (bash octal interpretation).

Test coverage gap

tests/semver.bats has 34 tests but does not cover leading zeros, empty identifiers, or leading/trailing dots. Textbook "high test count, insufficient specification coverage."

Blocking rationale

Core invariant of a release tool. Silent acceptance + downstream crash is a v1.0.0 blocker.

Fix

Either replace parser with reference implementation OR implement complete SemVer 2.0 grammar. Test cases required for every invalid input class above + 1.2.08 bump case.

Anchor

External correctness cold-read (anonymous ChatGPT session, uploaded to operator 2026-07-03). Full review surfaced 10 findings across 5 blocking-v1.0.0 + 2 should-fix pre-v1.0.0 + 3 post-v1.0.0 backlog. This tracker addresses one of them.

BLOCKING v1.0.0.

## Empirical failure `scripts/lib/semver.sh` claims SemVer 2.0.0 compliance but the regex at line 27 accepts these invalid values then crashes on bump: - `01.2.3`, `1.02.3`, `1.2.03` — leading zeros - `1.2.3-alpha..1` — empty identifier - `1.2.3-01` — numeric prerelease with leading zero - `1.2.3-.alpha`, `1.2.3-alpha.` — leading/trailing dot - `1.2.3+build..1` — empty build id Then crashes: `semver_bump patch 1.2.08` → `08: value too great for base` (bash octal interpretation). ## Test coverage gap `tests/semver.bats` has 34 tests but does not cover leading zeros, empty identifiers, or leading/trailing dots. Textbook "high test count, insufficient specification coverage." ## Blocking rationale Core invariant of a release tool. Silent acceptance + downstream crash is a v1.0.0 blocker. ## Fix Either replace parser with reference implementation OR implement complete SemVer 2.0 grammar. Test cases required for every invalid input class above + `1.2.08` bump case. ## Anchor External correctness cold-read (anonymous ChatGPT session, uploaded to operator 2026-07-03). Full review surfaced 10 findings across 5 blocking-v1.0.0 + 2 should-fix pre-v1.0.0 + 3 post-v1.0.0 backlog. This tracker addresses one of them. BLOCKING v1.0.0.

bosun added the

priority/critical

size/M

kind/bug

labels

2026-07-03 13:35:59 +02:00