mirror of
https://github.com/astral-sh/setup-uv.git
synced 2026-11-05 01:35:32 +00:00
80fbe0140c
## Summary `~=` is the PEP 440 compatible release operator, but the resolver tries `semver.validRange()` first, and semver accepts `~=` as a tilde range: | specifier | semver | PEP 440 | |---|---|---| | `~=0.9` | `>=0.9.0 <0.10.0` | `>=0.9, ==0.*` | So with the default `highest` strategy, `version: "~=0.9"` (or `required-version = "~=0.9"` picked up through `version-file`) installs the highest 0.9.x instead of the highest 0.x. The same happens with `manifest-file`, where `tc.evaluateVersions` is semver-based. This skips the semver evaluation for specifiers containing `~=`, so they are only evaluated with `@renovatebot/pep440`. No semver range legitimately uses `~=`. Notes: - Only a bare two-segment `~=X.Y` resolved incorrectly. `~=X.Y.Z` gives the same result in both, and compound specifiers like `~=0.9, !=0.9.3` were already rejected by semver and fell through to PEP 440. - `minSatisfying` gets the same check for consistency. The lower bound is the same under both interpretations, so `lowest` didn't produce wrong results before. - A single-segment `~=1` is invalid PEP 440. semver used to resolve it to 1.x; it now fails with `No version found for ~=1`, same as other invalid specifiers. ## Test plan - Added tests for `~=0.9` with the default manifest and with `manifest-file`. Both returned `0.9.26` instead of `0.10.2` before the change. - `npm run all` on Ubuntu (WSL) with Node 24.19.0: build, Biome (no fixes), packaging, and 161 tests across 15 suites pass. The rebuilt `dist/setup/index.cjs` only differs in the changed lines. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>