[BUG] subset() returns false for an upper-bound-only range such as subset('<2.0.0', '*') #949

Activity

1. hamarshehmhmd commented on Nov 7, 2026

   

   hamarshehmhmd

   on Nov 7, 2026

   More actions

   Reproduced on main (b37b033). Two separate spots in ranges/subset.js:

   1. <2.0.0 vs * / >=0.0.0: after * becomes >=0.0.0, the lt && hasDomGT && !gt check returns false outright. A missing lower bound in sub really means "bounded by the lowest version", so it should only fail if some >/>= in dom rejects that minimum.
   2. <1.0.0 vs 0.x: 0.x parses to <1.0.0-0, and lowerLT treats that as stricter than <1.0.0. Without includePrerelease they admit the same versions (the needDomLTPre block already makes this exception for sub, just not for dom).

   Patch:

          if (c.operator === '<' || c.operator === '<=') {
            lower = lowerLT(lt, c, options)
   -        if (lower === c && lower !== lt) {
   +        if (lower === c && lower !== lt && !sameUpperBound(lt, c, options)) {
              return false
            }
   @@
      if (lt && hasDomGT && !gt && gtltComp !== 0) {
   -    return false
   +    const min = options.includePrerelease
   +      ? minimumVersionWithPreRelease[0].semver
   +      : minimumVersion[0].semver
   +    const domAdmitsMin = dom.every(c =>
   +      (c.operator !== '>' && c.operator !== '>=') || c.test(min))
   +    if (!domAdmitsMin) {
   +      return false
   +    }
      }
   @@
   +// without includePrerelease, <1.2.3-0 admits the same versions as <1.2.3
   +const sameUpperBound = (lt, c, options) =>
   +  !options.includePrerelease &&
   +  lt.operator === '<' && c.operator === '<' &&
   +  !lt.semver.prerelease.length &&
   +  c.semver.prerelease.length === 1 && c.semver.prerelease[0] === 0 &&
   +  c.semver.major === lt.semver.major &&
   +  c.semver.minor === lt.semver.minor &&
   +  c.semver.patch === lt.semver.patch

   With the patch:

   subset('<2.0.0', '*')            true
   subset('<2', '*')                true
   subset('<2.0.0', '>=0.0.0')      true
   subset('<2.0.0', '>=0.0.0-0')    true
   subset('<1.0.0', '0.x')          true
   subset('<2.0.0', '>=0.0.1')      false   (still)
   subset('<2.0.0', '>=1.0.0')      false   (still)
   subset('<=1.0.0', '0.x')         false   (still)
   subset('<2.0.0', '>=0.0.0', { includePrerelease: true })  false  (0.0.0-0 is excluded)
   

   • Added those as cases in test/ranges/subset.js. npm test: all 54 test files pass, coverage stays at 100%.
   • I also brute-forced ~8k range pairs against satisfies() over a version grid. False negatives went from 316 to 158, and there are no new false positives. The 84 pre-existing ones are all prerelease sub ranges, so that's a separate issue.

   Happy to open a PR.