Skip to content

fix: honor semver prerelease rules in version resolution - #906

Open
Aschenbath wants to merge 2 commits into
nodejs:mainfrom
Aschenbath:fix/stable-range-resolution
Open

Aschenbath wants to merge 2 commits into
nodejs:mainfrom
Aschenbath:fix/stable-range-resolution

Conversation

@Aschenbath

@Aschenbath Aschenbath commented Oct 14, 2026 •

Copy link
Copy Markdown

A range such as pnpm@9 can select 9.1.0-0, and corepack up can move a stable project onto that prerelease. Registry resolution currently removes prerelease components while testing ranges; it also accepts a prerelease below an explicitly requested prerelease lower bound.

Use semver's standard range matcher for registry candidates, consistent with cache lookup. Exact prerelease versions, tags, and ranges that explicitly include prereleases remain supported. When the version selected by corepack up is a prerelease, keep that version as the lower bound within its major release line. This permits newer prereleases with the same major/minor/patch numbers and newer stable releases, without downgrading to an older stable version.

Package-manager configuration lookup retains its existing matcher so that explicitly selected development releases still resolve their binary layout correctly. The README describes registry range and upgrade behavior.

Fixes #473.
Fixes #774.

Validation on Node.js 22.23.3 in WSL:

  • corepack yarn build, corepack yarn typecheck, and corepack yarn lint --max-warnings=0 passed.
  • NOCK_ENV=replay corepack yarn test run --retry=0: 185 passed and one existing expected failure across nine files.
  • Fourteen CLI regressions pass against the local registry fixture, covering stable selection for use, global installation and up; explicit prerelease versions/ranges/tags; prerelease upgrades and promotion to stable; and rejection of out-of-range versions or downgrades. Rejected requests leave the manifest unchanged.
  • The fork Tests workflow passed all ten jobs on fc545280df617b575dba235206c43d3d43d50ed1: static checks and Node.js 22/24/26 across Linux, macOS, and Windows. All nine platform jobs ran and passed the fourteen prerelease regressions. The upstream workflow is awaiting maintainer approval.

The registry fixture serves opt-in prerelease versions and parses tarball names containing prerelease hyphens. Its ordinary version lists and signature checks remain in place. The full suite also passes the existing pnpm development-release binary-layout tests.

Implementation and automated validation were performed by Codex.

Signed-off-by: Nash Aschenbath <wwh86696@163.com>
Signed-off-by: Nash Aschenbath <wwh86696@163.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant