upgrade to newer semver, fixes #1817,#1845,#1851

[peterkc]

Upgrading to latest version of semver to fix (#1817, #1845, #1851).

Possible breaking changes in regards to the way semvers handles pre-releases.

If a version has a prerelease tags (for example, 1.2.3-alpha.3) then it will only be allowed to satisfy comparator sets if at least one comparator with the same [major, minor, patch] tuple also has a prerelease tag.

For example, the range >1.2.3-alpha.0 would be allowed to match the version 1.2.3-alpha.7, but it would not be satisfied by * or 1.2.3. See semvers additional details.

[maxhedouin]

+1

[lordbron]

+1

[yagoferrer]

+1

[rossman15]

+1

[stevemao]

why? its already in dependencies

[peterkc]

Good catch, that shouldn't be there; removed and PR rescoped.

[huerlisi]

AppVeyor and Travis CI builds failed. But according to a quick look not because of this code change but some failures other services.

Maybe you could do a repush so the checks are run again.

[trinityXmontoya]

• 1

[sheerun]

As you said it's breaking change so we can implement it only behind a flag.

[peterkc]

@sheerun It "COULD" be a breaking change base on the semver spec and description regarding pre-release identifier. Prior to semver 5.x, pre-releases version were satisfying comparator without at least one comparator with the same [major, minor, patch] tuple also has a prerelease tag.

I had added "COULD" be a breaking change in hopes that the contributors would review if it was.

[sheerun]

As for compatibility breaking your tests show it is indeed backward-incompatible. For example * could resolve to prerelease if package contained only prereleases. Now it fails. I think the incompatibility happens only when package consists of only pre-releases. It seems in the past we partly fixed this issue by 3d64222

Because it's not likely and lots of issues that were fixed until 5.x of node-semver, that it think it's reasonable to give it a go for 1.5..

Does your patch fix http://stackoverflow.com/questions/31144268/bower-no-suitable-angular-version/31274670 ? I still get "unable to find a suitable version for angular".

[peterkc]

@sheerun I'm not sure. Let me check in regards to the "unable to find a suitable version for angular" issue.

[peterkc]

@sheerun Hope this makes sense, or makes your head spin a bit. From what I can see, the output of that bower.json file is the following.

1) angular#>=1.2.16 <=1.3.16 which resolved to 1.3.16 and is required by angular-ui-grid#3.0.1
2) angular#1.3.17 which resolved to 1.3.17 and is required by angular-animate#1.3.17, angular-loader#1.3.17, angular-mocks#1.3.17, angular-route#1.3.17
3) angular#1.3.x which resolved to 1.3.17 and is required by MyApp
4) angular#>=1.3.0 which resolved to 1.4.3 and is required by angular-bootstrap#0.13.0
5) angular#* which resolved to 1.4.3 and is required by angular-spinkit#0.3.3

angular-ui-grid ~3.0.0-rc.20 is the limiting component, that requires angular ~1.2.16 which semver sees as >=1.2.16 <1.3.0.

Because semver 5.x will not match a prerelease, angular-ui-grid ~3.0.0-rc.20 is resolved to 3.0.1, which requires angular >=1.2.16 <=1.3.16.

MyApp requires requires angular 1.3.x which semver sees as >=1.3.0 <1.4.0.

This then restricts the range for angular that bower can work with >=1.3.0 <=1.3.16.

Bower then found only three possible angular versions that satisfies some of the components but not all.

1.3.16, 1.3.17, 1.4.3

Breaking down the versions for the above angular gives us:

angular 1.3.16

• angular-animate#1.3.17, requires angular 1.3.17, no
• angular-loader#1.3.17, requires angular 1.3.17, no
• angular-mocks#1.3.17, requires angular 1.3.17, no
• angular-route#1.3.17, requires angular 1.3.17, no
• MyApp, requires angular 1.3.x (:= >=1.3.0 <1.4.0), no
• angular-bootstrap#0.13.0, requires angular >=1.3.0, yes
• angular-ui-grid#3.0.1, requires angular >=1.2.16 <=1.3.16, yes

angular 1.3.17

• angular-animate#1.3.17, requires angular 1.3.17, yes
• angular-loader#1.3.17, requires angular 1.3.17, yes
• angular-mocks#1.3.17, requires angular 1.3.17, yes
• angular-route#1.3.17, requires angular 1.3.17, yes
• MyApp, requires angular 1.3.x (:= >=1.3.0 <1.4.0), yes
• angular-bootstrap#0.13.0, requires angular >=1.3.0, yes
• angular-ui-grid#3.0.1, requires angular >=1.2.16 <=1.3.16, no

angular 1.4.3

• angular-animate#1.3.17, requires angular 1.3.17, no
• angular-loader#1.3.17, requires angular 1.3.17, no
• angular-mocks#1.3.17, requires angular 1.3.17, no
• angular-route#1.3.17, requires angular 1.3.17, no
• MyApp, requires angular 1.3.x (:= >=1.3.0 <1.4.0), no
• angular-bootstrap#0.13.0, requires angular >=1.3.0, yes
• angular-ui-grid#3.0.1, requires angular >=1.2.16 <=1.3.16, no

Therefore, bower with semver 5.x seems to be behaving as intended.

[sheerun]

Makes sense. As I said the benefits overweight drawbacks (backward-incompatibility can only happen if package consists of only prereleases and user required non-prerelease version), so I'm merging it.

We'll rollback it, if we receive negative feedback.

[arty-name]

Would be nice to release that to npm :)