Filtering by version constraint is broken (Case 162267)

[janopae]

Here I searched for a certain library being < 2.10.0.0: https://baton.webfactory.de/package/webfactory/doctrine-bundle-default-config;html?operator=%3C&versionString=2.10.0.0

It shows usages of 2.0.1 and 2.0.3.

Here I searched for the same library being used in < 3.7.0.0: https://baton.webfactory.de/package/webfactory/doctrine-bundle-default-config;html?operator=%3C&versionString=3.7.0.0

The results include usages of 2.4.0, 2.5.0 and 2.8.3, which are all smaller than 2.10, yet didn't show up in the first search.

My assumption is that Baton treats the value of 2.10 as 2.1. This suspicion is amplified by the fact that in the sorted search results, 2.4 etc. appear after 2.10, while actually being smaller.

How does Baton compare versions? Does it understand SemVer, or does it just order the strings alphabetically?

[janopae]

@xkons just showed my the code lines that do the comparison.

Here, Baton compares a normalised string:

baton/src/AppBundle/Entity/VersionConstraint.php

Line 41 in dcee3bc

public function matches(PackageVersion $packageVersion)

The normalisation is done by Composer SemVer component.

However, I think there is no way to normalise SemVer versions in such a way that you can compare them alphabetically: You can always shove a new version in between by releasing a new minor or bugfix version. There is no way to model this with an alphabetical comparison. The closest you could get would be padding the version numbers with large amounts of leading zeroes, but this would still only allow for a finite number of minor/bugfix versions, while SemVer is defined to allow infinite minor/bugfix versions

That's why it didn't surprise me that the normalisation used here doesn't seem to guarentee that you can just compare the version strings to get the right order – instead, it just seems to strip aliasing, branch prefixes etc: https://github.com/composer/semver/blob/4313d26ada5e0c4edfbd1dc481a92ff7bff91f12/src/VersionParser.php#L108

Instead, we should replace the string comparisons with the functions provided by the composer/semver Comparator class, and use the Semver::sort function for sorting.

I'll see what I can do.