Skip to content

Reject leading-zero semver values in local evaluation#146

Closed
dmarticus wants to merge 3 commits into
mainfrom
dmarticus/strict-semver-leading-zeros
Closed

Reject leading-zero semver values in local evaluation#146
dmarticus wants to merge 3 commits into
mainfrom
dmarticus/strict-semver-leading-zeros

Conversation

@dmarticus
Copy link
Copy Markdown
Contributor

Summary

Per semver 2.0.0 §2, numeric identifiers MUST NOT include leading zeros. Values like 1.07.3 or 01.2.3 are not valid semver — the local feature flag evaluator currently parses them silently (via intval("07") → 7), which means a person property of 1.07.3 would incorrectly match a semver_eq condition against 1.7.3.

This PR makes the parser reject leading zeros in numeric identifiers. Both override values and flag values are validated; invalid inputs throw InconclusiveMatchException so the condition simply does not match.

Matches the same fix applied to posthog-python #601 and posthog-go #200.

Changes

  • parseSemver now uses a parseSemverNumeric helper that rejects strings with leading zeros (except literal "0").
  • wildcardBounds uses the same helper, so 01.* and 1.07.* are rejected.
  • Inverted the existing edge-case test testParseSemverLeadingZeros / testMatchPropertySemverLeadingZeros — they now assert rejection rather than acceptance.
  • Added comprehensive coverage for override values, flag values, and all range operators (semver_gt, semver_caret, semver_tilde, semver_wildcard).

Test plan

  • ./vendor/bin/phpunit --filter "Semver|parseSemver" test — 45 passed
  • New rejection tests pass
  • Literal 0 components still match (0.1.0, 1.0.0, 0.0.0)
  • Full suite has no new regressions (one pre-existing unrelated failure: testLoadFeatureFlagsWrongKey)
  • ./bin/fmt clean

Per semver 2.0.0 §2, numeric identifiers must not include leading zeros.
Values like "1.07.3" are not valid semver and should not match targeting
conditions. Both override values and flag values are validated; invalid
inputs surface an InconclusiveMatchError so the condition does not match.
@dmarticus dmarticus changed the base branch from feat/semver-targeting to main May 20, 2026 20:42
@dmarticus dmarticus requested a review from a team as a code owner May 20, 2026 20:42
@dmarticus
Copy link
Copy Markdown
Contributor Author

Closing in favor of #147 — was based on a stale feature branch; recreated against main.

@dmarticus dmarticus closed this May 20, 2026
@dmarticus dmarticus deleted the dmarticus/strict-semver-leading-zeros branch May 20, 2026 20:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant