[PR #954] [MERGED] fix(installer): validate exact semantic versions #2530

New issue

Closed

opened 2026-10-17 21:07:14 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:07:14 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/954
Author: @morluto
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @morluto

Base: main ← Head: codex/config-wave2-audit

📝 Commits (2)

1762e95 fix(installer): validate exact semantic versions
a2ebec2 fix(installer): reject npm-ambiguous build metadata

📊 Changes

2 files changed (+115 additions, -2 deletions)

View changed files

📝 install.sh (+12 -2)
📝 tests/boundary/filesystem/installScript.test.ts (+103 -0)

📄 Description

Summary

The curl installer’s version regex accepted malformed SemVer values such as 01.2.3, 1.2.3-01, and 1.2.3-alpha..1. On baseline, each value was accepted by --dry-run and printed as an install plan. The installer now validates pinned versions and the fetched latest release tag against SemVer’s numeric and prerelease identifier rules before invoking npm.

Although build metadata is valid SemVer, npm 11.16.0 strips it while resolving an exact package version. For example, requesting 1.2.3+build.01 resolves 1.2.3; the installer could then modify the global install and report a version mismatch. The installer now rejects versions and release tags with build metadata before printing a plan or invoking npm. Valid prerelease versions remain supported.

No actual package installation was performed, and this change does not install or upgrade unrelated software.

Validation

30 installer tests passed, including rejection of malformed SemVer and build metadata before the plan/npm, rejection of a malformed latest-release tag, and acceptance of a valid prerelease.
The other 75 focused config, setup, and update tests passed in the earlier six-file run.
bash -n install.sh, npm run build:cached, forced npm run check:fast, npm run format:check, and npm run docs:check passed.
npm pack --dry-run --json included the installer and runtime entrypoints, excluded src/, and contained no build-profile artifacts.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/954 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/config-wave2-audit` --- ### 📝 Commits (2) - [`1762e95`](https://github.com/morluto/rea/commit/1762e95f8850539cb5259f002f4faf2041f86c60) fix(installer): validate exact semantic versions - [`a2ebec2`](https://github.com/morluto/rea/commit/a2ebec2dd85a28c4ab5ba0831452b1bf669a805a) fix(installer): reject npm-ambiguous build metadata ### 📊 Changes **2 files changed** (+115 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `install.sh` (+12 -2) 📝 `tests/boundary/filesystem/installScript.test.ts` (+103 -0) </details> ### 📄 Description ## Summary The curl installer’s version regex accepted malformed SemVer values such as `01.2.3`, `1.2.3-01`, and `1.2.3-alpha..1`. On baseline, each value was accepted by `--dry-run` and printed as an install plan. The installer now validates pinned versions and the fetched latest release tag against SemVer’s numeric and prerelease identifier rules before invoking npm. Although build metadata is valid SemVer, npm 11.16.0 strips it while resolving an exact package version. For example, requesting `1.2.3+build.01` resolves `1.2.3`; the installer could then modify the global install and report a version mismatch. The installer now rejects versions and release tags with build metadata before printing a plan or invoking npm. Valid prerelease versions remain supported. No actual package installation was performed, and this change does not install or upgrade unrelated software. ## Validation - 30 installer tests passed, including rejection of malformed SemVer and build metadata before the plan/npm, rejection of a malformed latest-release tag, and acceptance of a valid prerelease. - The other 75 focused config, setup, and update tests passed in the earlier six-file run. - `bash -n install.sh`, `npm run build:cached`, forced `npm run check:fast`, `npm run format:check`, and `npm run docs:check` passed. - `npm pack --dry-run --json` included the installer and runtime entrypoints, excluded `src/`, and contained no build-profile artifacts. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:07:14 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2530

No description provided.

Rows
Columns