versionorder

Overview ¶

Package versionorder orders the versions of one package by the rules of the ecosystem it comes from.

Every ecosystem orders differently. Debian's `3.0.17-1~deb12u3` is newer than `3.0.17-1~deb12u2` and `1.0~rc1` is older than `1.0`; PEP 440 puts `1.0rc1` before `1.0` and `1.0.post1` after it; Maven's `2.13.4.2` follows `2.13.4`. A comparison that reads dotted numbers alone gets each of these wrong, and a wrong order recommends an upgrade that leaves findings behind or a downgrade of a working dependency.

The rules are osv-scalibr's, which are the ones OSV's own matching uses. Where the ecosystem is not one it orders, or a version does not parse in it, Compare says so rather than guessing, and the caller keeps every version it was given.