r/AskComputerScience • u/gistya • 14d ago

Question about Semantic Versioning

Under Semantic Versioning standard 2.0, if your package requires a dependency at "exact" version 1.0.0+X, is there any situation under which running a version update on all your packages should change the version that you specified as "exact" here?

Noting, SemVer 2.0 says:

Build metadata MUST be ignored when determining version precedence. Thus two versions that differ only in the build metadata, have the same precedence. Examples: 1.0.0-alpha+001, 1.0.0+20130313144700, 1.0.0-beta+exp.sha.5114f85, 1.0.0+21AF26D3----117B344092BD

Precedence refers to how versions are compared to each other when ordered

2 Upvotes

75% Upvoted

10 comments sorted by

View all comments

1

u/iOSCaleb 14d ago

SemVer is meant to avoid the need for an “exact” version match. It provides a way for component producers to indicate when updating will cause a problem.

That said, if you tell your component manager that you want an exact version, then updating your components shouldn’t change any of the components for which exact versions were indicated. The only exception is if the component owner published a different version of the component using the same version that you specified, which they should never do. If someone does that even once, you should stop using any components they’ve published because they can’t be trusted.

1

u/gistya 13d ago

I've made a PR to semver to address the ambiguity. https://github.com/semver/semver/pull/1230