Invalid version string "8.x-1.x-dev" #459

New Issue

2026-02-17T12:07:11-06:00

GiteaMirror commented

2026-02-17 12:07:11 -06:00

Originally created by @jderusse on GitHub (Feb 25, 2021).

When analyzing a composer.lock file sent by customer, I discovered this package:

        {
            "name": "foo/bar",
            "version": "8.x-1.x-dev",
            "...": "truncated"
        }

When parsing the version, Semver throws an UnexpectedValueException.

note: This exception, is also thrown when running $composer->getLocker()->getLockedRepository() when the ArrayLoader is loading the package.

So, I wonder, if this is a legitimate version, and if we should patch Semver?

Originally created by @jderusse on GitHub (Feb 25, 2021). When analyzing a `composer.lock` file sent by customer, I discovered this package: ```json { "name": "foo/bar", "version": "8.x-1.x-dev", "...": "truncated" } ``` When parsing the version, Semver throws an `UnexpectedValueException`. note: This exception, is also thrown when running `$composer->getLocker()->getLockedRepository()` when the `ArrayLoader` is loading the package. So, I wonder, if this is a legitimate version, and if we should patch Semver?

GiteaMirror closed this issue

2026-02-17 12:07:11 -06:00

GiteaMirror commented

2026-02-17 12:07:12 -06:00

@jjlharrison commented on GitHub (Feb 25, 2021):

I think https://github.com/npm/node-semver would be the correct repository for this issue. This repository is for the semver specification.

@jjlharrison commented on GitHub (Feb 25, 2021): I think https://github.com/npm/node-semver would be the correct repository for this issue. This repository is for the semver specification.

GiteaMirror commented

2026-02-17 12:07:12 -06:00

@ljharb commented on GitHub (Feb 25, 2021):

Not node; composer is PHP.

@ljharb commented on GitHub (Feb 25, 2021): Not node; composer is PHP.

GiteaMirror commented

2026-02-17 12:07:13 -06:00

@steveklabnik commented on GitHub (Feb 25, 2021):

Yes, this bug should be compiled against composer, not against the specification. Thank you!

@steveklabnik commented on GitHub (Feb 25, 2021): Yes, this bug should be compiled against composer, not against the specification. Thank you!

GiteaMirror commented

2026-02-17 12:07:13 -06:00

@steveklabnik commented on GitHub (Feb 25, 2021):

(on a non-procedural note: this is not a valid semver version. Now, usually what is put into files is a range, not a version, and ranges are not technically in the semver spec yet. https://github.com/semver/semver/pull/584 is the current draft of the proposal for adding it to the spec. I still have not had the time to actually review it yet. 2020 was quite the year. but it is likely (though I haven't used composer so i can't be 100% sure) that you'd want to compare this to that, but you'd really need the composer maintainers to say. it is very clearly not a semver version though. given this is in a lockfile, maybe this is a version, and so that would be some sort of bug in composer)

@steveklabnik commented on GitHub (Feb 25, 2021): (on a non-procedural note: this is not a valid semver version. Now, usually what is put into files is a *range*, not a *version*, and ranges are not technically in the semver spec yet. https://github.com/semver/semver/pull/584 is the current draft of the proposal for adding it to the spec. I still have not had the time to actually review it yet. 2020 was quite the year. but it is likely (though I haven't used composer so i can't be 100% sure) that you'd want to compare this to that, but you'd really need the composer maintainers to say. it is very clearly not a semver version though. given this is in a lockfile, maybe this *is* a version, and so that would be some sort of bug in composer)

GiteaMirror commented

2026-02-17 12:07:14 -06:00

@jderusse commented on GitHub (Feb 25, 2021):

oh sorry about the wrong repo

@jderusse commented on GitHub (Feb 25, 2021): oh sorry about the wrong repo