Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
compare-versions
Advanced tools
The compare-versions npm package is used to compare and sort semantic version numbers. It provides a simple API for comparing version strings in 'major.minor.patch' format, and it can be used in various environments such as Node.js, browsers, and as a command-line tool.
Compare versions
Compares two semantic version numbers and returns -1, 0, or 1 if the first version is less than, equal to, or greater than the second version, respectively.
const compareVersions = require('compare-versions');
console.log(compareVersions('1.2.3', '4.11.6')); // -1
Check if a version satisfies a range
Determines if a version satisfies a given range. It returns true if the version meets the criteria of the range, false otherwise.
const compareVersions = require('compare-versions');
console.log(compareVersions.satisfies('1.2.3', '>=1.0.0')); // true
Sort an array of versions
Sorts an array of semantic version numbers in ascending order.
const compareVersions = require('compare-versions');
const versions = ['1.2.3', '4.11.6', '2.0.0'];
versions.sort(compareVersions);
console.log(versions); // ['1.2.3', '2.0.0', '4.11.6']
semver is a popular package that provides a wide range of functions for manipulating and comparing semantic versions. It is more feature-rich than compare-versions, offering functions like coercion, ranges, and prerelease comparisons.
node-version-compare is another package for comparing version numbers. It is less popular and has a simpler API compared to compare-versions, focusing mainly on the comparison of version strings without additional features like range checking.
Compare semver version strings to find greater, equal or lesser. Runs in the browser as well as Node.js/React Native etc. Has no dependencies and is tiny (~630 bytes gzipped).
This library supports the full semver specification, including comparing versions with different number of digits like 1.0.0
, 1.0
, 1
, and pre-release versions like 1.0.0-alpha
. Additionally supports the following variations:
1.0.x
or 1.0.*
.25.0.1364.126
.v
is ignored, e.g. v1.0
is interpreted as 1.0
.1.01.1
is interpreted as 1.1.1
.$ npm install compare-versions
// ES6/TypeScript
import compareVersions from 'compare-versions';
// Node
var compareVersions = require('compare-versions');
compareVersions('10.1.8', '10.0.4'); // 1
compareVersions('10.0.1', '10.0.1'); // 0
compareVersions('10.1.1', '10.2.2'); // -1
Can also be used for sorting:
var versions = [
'1.5.19',
'1.2.3',
'1.5.5'
]
var sorted = versions.sort(compareVersions);
/*
[
'1.2.3',
'1.5.5',
'1.5.19'
]
*/
var sortDescending = versions.sort(compareVersions).reverse();
/*
[
'1.5.19'
'1.5.5',
'1.2.3',
]
*/
The normal compare function doesn't return a self-explanatory value (using 1
, 0
and -1
).
This version returns the boolean which fulfills the specified operator.
compareVersions.compare('10.1.8', '10.0.4', '>'); // return true
compareVersions.compare('10.0.1', '10.0.1', '='); // return true
compareVersions.compare('10.1.1', '10.2.2', '<'); // return true
compareVersions.compare('10.1.1', '10.2.2', '<='); // return true
compareVersions.compare('10.1.1', '10.2.2', '>='); // return false
Applies the same ruleset as used before comparing version numbers and returns a boolean:
compareVersions.validate('1.0.0-rc.1'); // return true
compareVersions.validate('1.0-rc.1'); // return false
compareVersions.validate('foo'); // return false
If included directly in the browser, compareVersions()
is available on the global window:
<script src="compare-versions/index.js"></script>
<script>
window.compareVersions('10.0.0', '10.1.0');
</script>
3.6.0 - 2020-02-13
validate()
function for checking whether a version number is semver-compliant.FAQs
Compare semver version strings to find greater, equal or lesser.
The npm package compare-versions receives a total of 4,721,417 weekly downloads. As such, compare-versions popularity was classified as popular.
We found that compare-versions demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.