Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Crates published with invalid semver version #2463

Closed
Nemo157 opened this issue Apr 27, 2020 · 8 comments
Closed

Crates published with invalid semver version #2463

Nemo157 opened this issue Apr 27, 2020 · 8 comments
Labels
A-backend ⚙️ C-bug 🐞 Category: unintended, undesired behavior

Comments

@Nemo157
Copy link
Member

Nemo157 commented Apr 27, 2020

I was looking at data in the docs.rs database and noticed this crate: https://crates.io/crates/hxgm30-client, I believe the version it specifies (0.3.0-alpha.01) is invalid according to the semver standard. I'm not 100% certain of this though, so have opened semver/semver#563 to clarify.

@hbina
Copy link
Contributor

hbina commented May 1, 2020

I believe this is very common?

@Nemo157
Copy link
Member Author

Nemo157 commented May 1, 2020

Not as far as I know, I don't have the data to hand anymore, but I believe this was the only crate I noticed with an invalid version in the docs.rs database (though, there could potentially be identical bugs in both the crates.io semver validator and pg-semver that result in them accepting the same superset of versions).

@steveklabnik
Copy link
Member

There have been other crates published due to this kind of bug in semver; IMHO we should fix the bug in semver, but also crates.io doesn't need to remove; cargo knows how to parse some incorrect versions and warn about it.

@Turbo87 Turbo87 added A-backend ⚙️ C-bug 🐞 Category: unintended, undesired behavior labels May 12, 2020
@Turbo87
Copy link
Member

Turbo87 commented Feb 11, 2021

this is blocked for now on dtolnay/semver#206 getting fixed

@jyn514
Copy link
Member

jyn514 commented Jun 27, 2021

dtolnay/semver#206 was fixed in semver 1.0.

@Rustin170506
Copy link
Member

Also, it has been upgraded in #3653.

@paolobarbolini
Copy link
Contributor

paolobarbolini commented Jun 28, 2021

Another example of this issue is with raft 0.5.0 specifying ~2.0-2.2 as the protobuf version

@Turbo87
Copy link
Member

Turbo87 commented Jun 28, 2021

I guess we can close this issue as the original issue is fixed.

I'm not sure what to do about the raft comment above, but I guess we can track that in a dedicated issue, since it's related to a dependency requirement, and not a version number itself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-backend ⚙️ C-bug 🐞 Category: unintended, undesired behavior
Projects
None yet
Development

No branches or pull requests

7 participants