semver: collapse a || union containing a match-all branch to * before the prerelease rule

src/semver/SemverQuery.rs

@@ -350,6 +350,10 @@
 impl Flags {
     pub const PRE: usize = 1;
     pub const BUILD: usize = 0;
+    /// Set when an explicit `||` union contains a branch that is entirely the
+    /// ANY comparator (`*`, `x`, `>=0.0.0`, ...). node-semver collapses such a
+    /// range to `*` before applying the prerelease rule.
+    pub const MATCH_ALL_BRANCH: usize = 2;
 }
 
 pub struct Group {
@@ -462,6 +466,7 @@
         let range = &self.head.head.range;
         if self.head.next.is_none()
             && self.head.head.next.is_none()
+            && !self.flags.is_set(Flags::MATCH_ALL_BRANCH)
             && range.has_left()
             && range.left.op == RangeOp::Eql
             && !range.has_right()
@@ -498,6 +503,7 @@
     pub fn is_exact(&self) -> bool {
         self.head.next.is_none()
             && self.head.head.next.is_none()
+            && !self.flags.is_set(Flags::MATCH_ALL_BRANCH)
             && !self.head.head.range.has_right()
             && self.head.head.range.left.op == RangeOp::Eql
     }
@@ -578,6 +584,11 @@
     #[inline]
     pub fn satisfies(&self, version: Version, group_buf: &[u8], version_buf: &[u8]) -> bool {
         if version.tag.has_pre() {
+            // node-semver collapses a `||`-union containing a match-all branch
+            // to `*`, which then rejects every prerelease (see range.js L57-67).
+            if self.flags.is_set(Flags::MATCH_ALL_BRANCH) {
+                return false;
+            }
             self.head.satisfies_pre(version, group_buf, version_buf)
         } else {
             self.head.satisfies(version, group_buf, version_buf)
@@ -855,6 +866,8 @@
     let mut count: u32 = 0;
     let mut skip_round;
     let mut is_or = false;
+    let mut saw_or_separator = false;
+    let mut branch_has_non_any = false;
 
     while i < input.len() {
         skip_round = false;
@@ -926,6 +939,11 @@
                 while i < input.len() && input[i] == b' ' {
                     i += 1;
                 }
+                if !branch_has_non_any {
+                    list.flags.set_value(Flags::MATCH_ALL_BRANCH, true);
+                }
+                saw_or_separator = true;
+                branch_has_non_any = false;
                 is_or = true;
                 token.tag = TokenTag::None;
                 skip_round = true;
@@ -953,6 +971,9 @@
                 while i < input.len() && input[i] != b' ' && input[i] != b'|' {
                     i += 1;
                 }
+                // node-semver loose mode drops these tokens via `.filter(c => c.length)`
+                // before the collapse-to-`*` step, so a garbage-only branch is not ANY.
+                branch_has_non_any = true;
                 skip_round = true;
             }
         }
@@ -1074,6 +1095,9 @@
                     },
                 };
 
+                if !range.is_match_all() {
+                    branch_has_non_any = true;
+                }
                 if is_or {
                     list.or_range(&range)?;
                 } else {
@@ -1090,21 +1114,29 @@
                 // tag, like "1 || - foo".
                 token.wildcard = Wildcard::None;
                 continue;
-            } else if count == 0 && token.tag == TokenTag::Version {
-                match parse_result.wildcard {
-                    Wildcard::None => {
-                        list.or_version(version)?;
-                    }
-                    _ => {
-                        list.or_range(&token.to_range(&parse_result.version))?;
-                    }
-                }
-            } else if count == 0 {
-                list.and_range(&token.to_range(&parse_result.version))?;
-            } else if is_or {
-                list.or_range(&token.to_range(&parse_result.version))?;
+            } else if count == 0
+                && token.tag == TokenTag::Version
+                && parse_result.wildcard == Wildcard::None
+            {
+                branch_has_non_any = true;
+                list.or_version(version)?;
             } else {
-                list.and_range(&token.to_range(&parse_result.version))?;
+                let range = token.to_range(&parse_result.version);
+                // A bare operator with no operand (`^`, `~`, `>=` at end of
+                // branch) parses len==0 and node-semver loose mode drops it
+                // before the collapse step, so it is not the ANY comparator.
+                if !range.is_match_all() || parse_result.len == 0 {
+                    branch_has_non_any = true;
+                }
+                if count == 0 && token.tag == TokenTag::Version {
+                    list.or_range(&range)?;
+                } else if count == 0 {
+                    list.and_range(&range)?;
+                } else if is_or {
+                    list.or_range(&range)?;
+                } else {
+                    list.and_range(&range)?;
+                }
             }
 
             is_or = false;
@@ -1113,5 +1145,9 @@
         }
     }
 
+    if saw_or_separator && !branch_has_non_any {
+        list.flags.set_value(Flags::MATCH_ALL_BRANCH, true);
+    }
+
     Ok(list)
 }

src/semver/SemverRange.rs

@@ -131,6 +131,19 @@ impl Range {
         self.right.op != Op::Unset
     }
 
+    /// True when this range is node-semver's ANY comparator (`*` / `x` /
+    /// `>=0.0.0`): it accepts every release version and, under the default
+    /// prerelease rule, no prerelease.
+    pub fn is_match_all(self) -> bool {
+        if !self.has_left() {
+            return true;
+        }
+        self.left.op == Op::Gte
+            && self.left.version.is_zero()
+            && !self.left.version.tag.has_pre()
+            && !self.has_right()
+    }
+
     /// Is the Range equal to another Range
     /// This does not evaluate the range.
     #[inline]

test/cli/install/semver.test.ts

@@ -357,6 +357,46 @@ describe("Bun.semver.satisfies()", () => {
 
     testSatisfies("^3.0.0-next.0||^3.0.0", "3.0.0-next.2", true);
 
+    // node-semver collapses a `||`-union containing a match-all branch to `*`
+    // before applying the prerelease rule, so the prerelease is rejected even
+    // though a sibling branch names it explicitly.
+    for (const any of ["*", "x", "X", "x.x", "x.x.x", ">=0.0.0", ">=0.0.0+build", "* *", "0.0.0 - x", "^*", "~*", ""]) {
+      testSatisfies(`${any} || 1.2.3-alpha.1`, "1.2.3-alpha.1", false);
+      testSatisfies(`1.2.3-alpha.1 || ${any}`, "1.2.3-alpha.1", false);
+      testSatisfies(`${any} || ^1.2.3-alpha`, "1.2.3-alpha.1", false);
+      testSatisfies(`${any} || 1.2.3-alpha.1 || ${any}`, "1.2.3-alpha.1", false);
+    }
+    for (const any of ["*", "x", "X", "x.x", "x.x.x", ">=0.0.0", ">=0.0.0+build", "* *", "0.0.0 - x"]) {
+      // A release version still satisfies the collapsed `*`.
+      testSatisfies(`${any} || 1.2.3-alpha.1`, "1.2.4", true);
+    }
+    testSatisfies("|| 1.2.3-alpha.1", "1.2.3-alpha.1", false);
+    testSatisfies("1.2.3-alpha.1 ||", "1.2.3-alpha.1", false);
+    // A non-match-all first branch keeps union semantics.
+    testSatisfies("1.x || 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    testSatisfies(">0.0.0 || 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    testSatisfies(">=1.0.0 || 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    // `>=0.0.0-0` has a prerelease tag so it is not the ANY comparator.
+    testSatisfies(">=0.0.0-0 || 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    // `*` alongside a narrower comparator in the same `||`-branch is not a
+    // match-all branch: node-semver drops the `*` and keeps the narrower one.
+    testSatisfies("* 2.0.0 || 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    testSatisfies("2.0.0 * || 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    testSatisfies("2.0.0 || * 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    testSatisfies("* 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    // A dist-tag/garbage branch is dropped by node-semver loose mode before
+    // the collapse-to-`*` step, so it is not a match-all branch.
+    testSatisfies("1.2.3-alpha.1 || boop", "1.2.3-alpha.1", true);
+    testSatisfies("boop || 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    testSatisfies("1.2.3-alpha.1 || latest", "1.2.3-alpha.1", true);
+    testSatisfies("latest || 1.2.3-alpha.1", "1.2.3-alpha.1", true);
+    testSatisfies("boop || * || 1.2.3-alpha.1", "1.2.3-alpha.1", false);
+    // A bare operator with no operand is likewise dropped, not treated as `*`.
+    for (const op of ["^", "~", ">=", ">", "<", "<=", "=", "v"]) {
+      testSatisfies(`1.2.3-alpha.1 || ${op}`, "1.2.3-alpha.1", true);
+      testSatisfies(`${op} || 1.2.3-alpha.1`, "1.2.3-alpha.1", true);
+    }
+
     const notPassing = [
       "0.1.0",
       "0.10.0",