Documentation
¶
Index ¶
- func CeilingTarget(current string, available []string, maxUpdate, ecosystem string) string
- func CompareVersions(v, target, ecosystem string) int
- func ConstraintMatches(c, v string) bool
- func DominantUpdateType(d VersionDelta) string
- func IsDateLikeVersion(v *masterminds.Version) bool
- func IsPrerelease(v string) bool
- func IsVersionLike(value string) bool
- func IsWildcardConstraint(c string) bool
- func LatestEligibleSemver(current string, available []string) string
- func LatestSatisfying(constraint string, available []string) string
- func ParseVersion(s string) *masterminds.Version
- func Satisfies(constraint, v string) bool
- func SelectConstraint(c string, available []string) string
- func ValidateConstraint(c string) error
- type DecomposedTag
- type VersionDelta
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CeilingTarget ¶
CeilingTarget selects the highest version in `available` whose update-type from `current` does not exceed the max_update ceiling ("major" > "minor" > "patch"; empty/unknown defaults to "minor"). It is the re-target used when a dependency's natural latest exceeds the ceiling but a lower in-ceiling upgrade exists — e.g. patch-lock grabbing the newest patch of the CURRENT minor rather than holding on a minor bump. Only versions strictly newer than `current` are considered.
Returns "" when nothing in `available` is both newer than `current` and within the ceiling — the caller then holds the dependency. Yanked/prerelease filtering is the caller's responsibility (it has that metadata); this is pure selection.
func CompareVersions ¶
CompareVersions reports whether version v sorts before (-1), equal to (0), or after (1) target, using ecosystem-aware semver. Unparseable inputs compare equal (0). Exported for the dependency remediator, which must decide whether a resolved transitive dependency has reached an advisory's fixed version.
func ConstraintMatches ¶
ConstraintMatches reports whether version v satisfies constraint c: every FIXED component of c equals v's corresponding component; wildcard components match anything (and, being trailing, end the check). Assumes c passed ValidateConstraint.
func DominantUpdateType ¶
func DominantUpdateType(d VersionDelta) string
DominantUpdateType is the exported form of dominantUpdateType. It returns "major", "minor", or "patch" for the highest-priority axis in a delta.
func IsDateLikeVersion ¶
func IsDateLikeVersion(v *masterminds.Version) bool
IsDateLikeVersion returns true if the version looks like a date (YYYYMMDD) rather than real semver. These show up in Docker Hub tags for Alpine, Ubuntu, etc. and would otherwise win any semver comparison (20220328.0.0 > 3.22.1).
func IsPrerelease ¶
IsPrerelease reports whether v carries a semver pre-release component (e.g. "1.2.0-rc1"). Unparseable versions are treated as non-prerelease.
func IsVersionLike ¶
IsVersionLike reports whether value looks like a semver/numeric version, optionally with a leading "v" (e.g. "1.2.3", "8.3", "v0.31.1"). Branch names and arbitrary refs ("develop", "master", "main") are NOT version-like and must not be treated as updatable dependencies.
func IsWildcardConstraint ¶
IsWildcardConstraint reports whether c contains a wildcard component ("x"/"X").
func LatestEligibleSemver ¶
LatestEligibleSemver returns the highest version in `available` compatible with the caret range of a BARE `current` (^current). Retained as the caret-convenience form; it delegates to LatestSatisfying, which also honors explicit operators.
func LatestSatisfying ¶
LatestSatisfying returns the highest version in `available` that satisfies the raw manifest `constraint`, HONORING its operator: "^1.8"/"~1.2"/"=1.8.0"/">=1, <2"/ "1.8.*" all mean what the ecosystem says. A bare version ("1.8.0", no operator) follows the caret convention (Cargo/npm treat it as ^1.8.0). Empty if the constraint is unparseable or nothing in `available` satisfies it. Yanked/prerelease filtering is the caller's job. This is the "honor the native constraint" selector — it replaces treating every manifest pin as a caret.
func ParseVersion ¶
func ParseVersion(s string) *masterminds.Version
ParseVersion attempts to parse a version string, stripping leading 'v'.
func Satisfies ¶
Satisfies reports whether a SPECIFIC version v meets the raw manifest constraint (operator honored, bare = caret). The version-level counterpart of LatestSatisfying, used to test one candidate — e.g. an advisory's fixed-in — against declared policy.
func SelectConstraint ¶
SelectConstraint returns the highest STABLE version in `available` that satisfies c, or "" if none. Pre-releases are excluded (deterministic default). This is the candidate-set-to-selection step for a resolved constraint.
func ValidateConstraint ¶
ValidateConstraint checks a constraint's grammar and returns the first problem, or nil. Rules: each component is a non-negative integer or the wildcard "x"; wildcards must be trailing (suffix-contiguous — no fixed component after an "x"); and a bare partial ("1.26": fewer than 3 fixed components, no wildcard) is rejected as ambiguous — write "1.26.x" for the line or a full version.
Types ¶
type DecomposedTag ¶
type DecomposedTag struct {
Version *masterminds.Version
Suffix string // raw suffix after first hyphen (unchanged for downstream consumers)
Family string // normalized family key for grouping
PreRank int // pre-release rank: 0=stable, 1=rc, 2=beta, 3=alpha, 4=dev
PreNum int // pre-release number: beta17 → 17
Precision int // numeric components in the ORIGINAL version token: "8"→1, "8.3"→2, "8.3.1"→3
Raw string
}
DecomposedTag holds the semver portion and any suffix of a container tag. Example: "1.25-alpine" → Version "1.25.0", Suffix "alpine", Family "alpine"
"3.22.1" → Version "3.22.1", Suffix "", Family "" "noble" → nil Version (non-versioned) "2026.1.30-ad42b553b" → Version "2026.1.30", Suffix "ad42b553b", Family ""
Suffix is preserved as the raw string after the first hyphen for downstream consumers (detectAlpineVersion, detectDebianDistro). Family is a normalized key used only for tag grouping — it strips per-release metadata like commit hashes, rebuild numbers, and pre-release counters.
func DecomposeTag ¶
func DecomposeTag(tag string) DecomposedTag
DecomposeTag splits a tag string into its semver version, suffix, and normalized family key. Returns a non-nil Version when the tag starts with a parseable version.
Classification pipeline (ordered — first match wins):
- MinIO RELEASE.YYYY-MM-DDTHH-MM-SSZ → encoded as semver date
- sha-<hash> prefix → non-versioned, Family "sha"
- Standard decomposition with progressive parsing for 4+ dot versions
func FilterTagsByFamily ¶
func FilterTagsByFamily(tags []string, family string) []DecomposedTag
FilterTagsByFamily returns tags from the list that share the same normalized family key, excluding date-like tags (e.g. "20220328") that aren't real semver.
func FilterTagsByVersionLine ¶
func FilterTagsByVersionLine(tags []string, current DecomposedTag) []DecomposedTag
FilterTagsByVersionLine returns tags that pin the SAME version line and the EXACT same variant suffix as current. The version line is defined by current's precision: precision 1 ("8") constrains to the same major; precision ≥2 ("8.3", "8.3.1") constrains to the same major AND minor. This respects the line the current tag pins and preserves its variant — so "8.3-fpm-alpine" never jumps to "8.4"/"8.5" and never changes to "fpm-alpine3.23". Tilde-style (version-line) semantics, distinct from the caret range used for Go/Cargo.
func LatestInFamily ¶
func LatestInFamily(tags []DecomposedTag) *DecomposedTag
LatestInFamily finds the best version among decomposed tags, preferring stable releases over pre-releases at the same version.
type VersionDelta ¶
VersionDelta describes how far behind a dependency is.
func CompareDependencyVersions ¶
func CompareDependencyVersions(current, latest, ecosystem string) VersionDelta
CompareDependencyVersions is the exported form of compareDependencyVersions. It dispatches to ecosystem-aware version comparison and returns a VersionDelta.
func (VersionDelta) IsZero ¶
func (d VersionDelta) IsZero() bool
IsZero returns true when there is no version difference.
Source Files