PyPI prerelease versions are mis-parsed (5.2b1 becomes 5.0.0)

[marylinmilo1]

Prerelease versions like 5.2b1 are not parsed correctly. The suffix is dropped and the version is reduced to 5.0.0, which makes comparisons and bounded ranges wrong.

n, _ := vers.Normalize("5.2b1")
fmt.Println(n) // "5.0.0"  (should be ordered as 5.2 beta 1)

fmt.Println(vers.CompareWithScheme("5.1", "5.2b1", "pypi")) // 1  (says 5.1 > 5.2b1, which is wrong)

r, _ := vers.Parse("vers:pypi/<5.2b1|>=5.1")
fmt.Println(r.Contains("6.0.3")) // true  (should be false; 6.0.3 is well outside the range)

Because 5.2b1 is read as 5.0.0, a range meant to cover a small prerelease window ends up matching everything from the lower bound on.

This affects all PEP 440 prerelease forms (a, b, rc, .dev, .post). Expected ordering per PEP 440: 1.0.dev1 < 1.0a1 < 1.0b1 < 1.0rc1 < 1.0 < 1.0.post1.

[andrew]

Confirmed, this is a bug on our side.

parseDotSeparated in version.go splits 5.2b1 into ["5", "2b1"] and then does strconv.Atoi("2b1"), discarding the error. Minor ends up as 0 and the b1 suffix is dropped entirely, so the version parses as {5, 0, 0, ""}. Same thing happens to 1.0.dev1 and 1.0.post1 on the third segment.

The range case follows from that: <5.2b1|>=5.1 is intersected into [5.1, 5.2b1), but Interval.IsEmpty() compares 5.1 against the mis-parsed 5.0.0, decides the interval is empty, and falls back to the union (-inf, 5.2b1) ∪ [5.1, +inf). 6.0.3 lands in the second half.

There's also no pypi case in CompareWithScheme, so even with the parse fixed, .post1 and .dev would still order wrong under generic semver rules. And Range.Contains calls CompareVersions rather than the scheme-aware comparator, so a pypi comparator wouldn't be reached during containment anyway.

The upstream conformance suite has no pypi prerelease cases, which is why CI is green.

Fix needs three parts: stop dropping the alpha suffix in parseDotSeparated, add a PEP 440 comparator, and thread the scheme through Range so containment uses it. The same underlying problems affect other ecosystems too; tracking that separately in #25.