fix: strip build metadata before comparator trimming (#869)

owlstronaut · web-flow · commit 17aa702d9116 · 2026-05-21T11:17:50.000-07:00
diff --git a/classes/range.js b/classes/range.js
@@ -98,6 +98,9 @@ class Range {
   }
 
   parseRange (range) {
+    // strip build metadata so it can't bleed into the version
+    range = range.replace(BUILDSTRIPRE, '')
+
     // memoize range parsing for performance.
     // this is a very hot path, and fully deterministic.
     const memoOpts =
@@ -223,13 +226,17 @@ const debug = require('../internal/debug')
 const SemVer = require('./semver')
 const {
   safeRe: re,
+  src,
   t,
   comparatorTrimReplace,
   tildeTrimReplace,
   caretTrimReplace,
 } = require('../internal/re')
 const { FLAG_INCLUDE_PRERELEASE, FLAG_LOOSE } = require('../internal/constants')
 
+// unbounded global build-metadata stripper used by parseRange
+const BUILDSTRIPRE = new RegExp(src[t.BUILD], 'g')
+
 const isNullSet = c => c.value === '<0.0.0-0'
 const isAny = c => c.value === ''
 
diff --git a/test/fixtures/range-parse.js b/test/fixtures/range-parse.js
@@ -116,4 +116,18 @@ module.exports = [
   ['>1.x.x-alpha+build', '>=2.0.0', null],
   ['>=1.x.x-alpha+build <2.x.x+build', '>=1.0.0 <2.0.0-0', null],
   ['1.x.x-alpha+build || 2.x.x+build', '>=1.0.0 <2.0.0-0||>=2.0.0 <3.0.0-0', null],
+  // long build metadata must be stripped, not bled into the version
+  ['4.17.0+' + 'a'.repeat(250) + '3', '4.17.0', { loose: true }],
+  ['4.17.0+' + 'a'.repeat(251), '4.17.0', { loose: true }],
+  ['v1.0+' + 'a'.repeat(249) + 'x6', '>=1.0.0 <1.1.0-0', null],
+  ['1.2.3+' + 'a'.repeat(251) + ' - 2.0.0', '>=1.2.3 <=2.0.0', null],
+  ['1.2.3+' + 'a'.repeat(251) + ' - 2.0.0', '>=1.2.3 <=2.0.0', { loose: true }],
+  ['> 1.2.3+' + 'a'.repeat(251), '>1.2.3', null],
+  ['>= 1.2.3+' + 'a'.repeat(251), '>=1.2.3', { loose: true }],
+  ['~1.2.3+' + 'a'.repeat(251), '>=1.2.3 <1.3.0-0', null],
+  ['^1.2.3+' + 'a'.repeat(251), '>=1.2.3 <2.0.0-0', null],
+  ['1.2.3+sha512.' + 'a'.repeat(251), '1.2.3', { loose: true }],
+  ['1.2.3+sha256.' + 'a'.repeat(200) + '.' + 'b'.repeat(200), '1.2.3', { loose: true }],
+  ['1.2.3+' + 'a'.repeat(251) + ' || 2.0.0+' + 'b'.repeat(251),
+    '1.2.3||2.0.0', { loose: true }],
 ]
