fix: reject leading-zero semver values in local evaluation

[dmarticus]

Summary

Per semver 2.0.0 §2, numeric identifiers MUST NOT include leading zeros. Values like 1.07.3 or 01.2.3 are not valid semver — the local feature flag evaluator currently parses them silently (via int("07") → 7), which means a person property of 1.07.3 would incorrectly match a semver_eq condition against 1.7.3.

This PR makes the parser reject leading zeros in numeric identifiers. Both override values and flag values are validated; invalid inputs raise InconclusiveMatchError so the condition simply does not match.

Changes

• parse_semver now uses a _semver_numeric_identifier helper that rejects strings with leading zeros (except literal "0").
• _wildcard_bounds uses the same helper, so 01.* and 1.07.* are rejected.
• Updated the existing edge-case test that previously asserted 01.02.03 matched 1.2.3 — it now correctly rejects.
• Added test_match_properties_semver_rejects_leading_zeros covering override values, flag values, and all range operators.

Test plan

• pytest posthog/test/test_feature_flags.py — 128 passed
• New rejection tests pass
• ruff format clean
• No new mypy errors on feature_flags.py

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
posthog/test/test_feature_flags.py:4572-4622
**Prefer `@pytest.mark.parametrize` over manual `for` loops**

The custom instruction for this repo says "We always prefer parameterised tests." The inner `for bad_value in [...]` loop is a manual workaround: when the first iteration fails the loop aborts, masking all subsequent failures. The entire method also bundles several independent concerns (invalid override values, invalid flag values, range operators) into one test, which makes failures hard to pinpoint. Each group of logically-related cases should be its own `@pytest.mark.parametrize`-driven test, matching the pattern of the existing semver tests in this file.

_{Reviews (1): Last reviewed commit: "Reject semver values with leading zeros ..." | Re-trigger Greptile}

[github-actions]

posthog-python Compliance Report

Date: 2026-05-21 16:04:41 UTC
Duration: 4674542ms

⚠️ Some Tests Failed

29/45 tests passed, 16 failed

---

Capture Tests

✅ 29/29 tests passed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	515ms
Format Validation.Event Has Uuid	✅	1507ms
Format Validation.Event Has Lib Properties	✅	1505ms
Format Validation.Distinct Id Is String	✅	1506ms
Format Validation.Token Is Present	✅	1506ms
Format Validation.Custom Properties Preserved	✅	1506ms
Format Validation.Event Has Timestamp	✅	1506ms
Retry Behavior.Retries On 503	✅	9517ms
Retry Behavior.Does Not Retry On 400	✅	3504ms
Retry Behavior.Does Not Retry On 401	✅	3508ms
Retry Behavior.Respects Retry After Header	✅	9513ms
Retry Behavior.Implements Backoff	✅	23527ms
Retry Behavior.Retries On 500	✅	7498ms
Retry Behavior.Retries On 502	✅	7516ms
Retry Behavior.Retries On 504	✅	7509ms
Retry Behavior.Max Retries Respected	✅	23523ms
Deduplication.Generates Unique Uuids	✅	1500ms
Deduplication.Preserves Uuid On Retry	✅	7514ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	14519ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	7507ms
Deduplication.No Duplicate Events In Batch	✅	1502ms
Deduplication.Different Events Have Different Uuids	✅	1506ms
Compression.Sends Gzip When Enabled	✅	1506ms
Batch Format.Uses Proper Batch Structure	✅	1506ms
Batch Format.Flush With No Events Sends Nothing	✅	1004ms
Batch Format.Multiple Events Batched Together	✅	1505ms
Error Handling.Does Not Retry On 403	✅	3508ms
Error Handling.Does Not Retry On 413	✅	3505ms
Error Handling.Retries On 408	✅	7511ms

Feature_Flags Tests

⚠️ 0/16 tests passed, 16 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	❌	507ms
Request Payload.Flags Request Uses V2 Query Param	❌	300524ms
Request Payload.Flags Request Hits Flags Path Not Decide	❌	300932ms
Request Payload.Flags Request Omits Authorization Header	❌	301085ms
Request Payload.Token In Flags Body Matches Init	❌	300903ms
Request Payload.Groups Round Trip	❌	301054ms
Request Payload.Groups Default To Empty Object	❌	301041ms
Request Payload.Person Properties Distinct Id Auto Populated When Caller Omits It	❌	300994ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	❌	300999ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	301007ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	❌	300964ms
Request Lifecycle.No Flags Request On Init Alone	❌	301037ms
Request Lifecycle.No Flags Request On Normal Capture	❌	300977ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	❌	300946ms
Request Lifecycle.Mock Response Value Is Returned To Caller	❌	301016ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	❌	301054ms

Failures

request_payload.request_with_person_properties_device_id

Field 'token' not found in /flags request body at path 'token'. Available keys: ['distinct_id', 'groups', 'person_properties', 'group_properties', 'geoip_disable', 'device_id', 'flag_keys_to_evaluate', 'sentAt', 'api_key']

request_payload.flags_request_uses_v2_query_param

No error message

request_payload.flags_request_hits_flags_path_not_decide

No error message

request_payload.flags_request_omits_authorization_header

No error message

request_payload.token_in_flags_body_matches_init

No error message

request_payload.groups_round_trip

No error message

request_payload.groups_default_to_empty_object

No error message

request_payload.person_properties_distinct_id_auto_populated_when_caller_omits_it

No error message

request_payload.disable_geoip_false_propagates_as_geoip_disable_false

No error message

request_payload.disable_geoip_omitted_defaults_to_false

No error message

request_payload.flag_keys_to_evaluate_contains_only_requested_key

No error message

request_lifecycle.no_flags_request_on_init_alone

No error message

request_lifecycle.no_flags_request_on_normal_capture

No error message

request_lifecycle.two_flag_calls_produce_two_remote_requests

No error message

request_lifecycle.mock_response_value_is_returned_to_caller

No error message

side_effect_events.get_feature_flag_captures_feature_flag_called_event

No error message

[marandaneto]

missing changelog entry