fix: reject non-semver candidate versions in isVersionSatisfies (#1009) · GlobalSecurityScan/setup-java@baa1691 · GitHub
Skip to content

Commit baa1691

Browse files
sproctorclaude
andauthored
fix: reject non-semver candidate versions in isVersionSatisfies (actions#1009)
Distributions like JetBrains Runtime publish 4-segment versions such as '17.0.8.1+1080.1' that the semver package rejects. Both compareBuild and satisfies throw on these, which surfaced to users as "Error: Invalid Version: 17.0.8.1+1080.1" and aborted the whole install when any available version was non-semver. Guard with an early semver.valid check so unparseable versions are treated as a non-match. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent bc52a13 commit baa1691

4 files changed

Lines changed: 27 additions & 1 deletion

File tree

‎__tests__/util.test.ts‎

Lines changed: 5 additions & 1 deletion

‎dist/cleanup/index.js‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52208,6 +52208,13 @@ function getDownloadArchiveExtension() {
5220852208
exports.getDownloadArchiveExtension = getDownloadArchiveExtension;
5220952209
function isVersionSatisfies(range, version) {
5221052210
var _a;
52211+
// Some distributions (e.g. JetBrains Runtime) publish 4-segment versions
52212+
// like '17.0.8.1+1080.1' that semver rejects. If the candidate version
52213+
// isn't valid semver, it can't match — bail out rather than letting
52214+
// compareBuild / satisfies throw.
52215+
if (!semver.valid(version)) {
52216+
return false;
52217+
}
5221152218
if (semver.valid(range)) {
5221252219
// if full version with build digit is provided as a range (such as '1.2.3+4')
5221352220
// we should check for exact equal via compareBuild

‎dist/setup/index.js‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81039,6 +81039,13 @@ function getDownloadArchiveExtension() {
8103981039
exports.getDownloadArchiveExtension = getDownloadArchiveExtension;
8104081040
function isVersionSatisfies(range, version) {
8104181041
var _a;
81042+
// Some distributions (e.g. JetBrains Runtime) publish 4-segment versions
81043+
// like '17.0.8.1+1080.1' that semver rejects. If the candidate version
81044+
// isn't valid semver, it can't match — bail out rather than letting
81045+
// compareBuild / satisfies throw.
81046+
if (!semver.valid(version)) {
81047+
return false;
81048+
}
8104281049
if (semver.valid(range)) {
8104381050
// if full version with build digit is provided as a range (such as '1.2.3+4')
8104481051
// we should check for exact equal via compareBuild

‎src/util.ts‎

Lines changed: 8 additions & 0 deletions

0 commit comments

Comments
 (0)