Security News
Supply Chain Attack Detected in Solana's web3.js Library
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
The semver package is a module for semantic versioning (semver) parsing and comparison. It provides utilities for working with semantic version numbers, allowing users to parse, compare, increment, and manipulate version numbers according to the semantic versioning specification.
Parsing and Validating Versions
This feature allows you to parse a version string and check if it is a valid semantic version.
"const semver = require('semver');
const version = '1.2.3';
const valid = semver.valid(version); // '1.2.3'"
Comparing Versions
This feature enables you to compare two semantic version numbers to determine their order.
"const semver = require('semver');
const v1 = '1.2.3';
const v2 = '4.5.6';
const comparison = semver.compare(v1, v2); // -1"
Incrementing Versions
This feature allows you to increment a version number by the major, minor, or patch version.
"const semver = require('semver');
const version = '1.2.3';
const incremented = semver.inc(version, 'patch'); // '1.2.4'"
Ranges and Satisfaction
This feature checks if a version satisfies a given range.
"const semver = require('semver');
const version = '1.2.3';
const range = '^1.0.0';
const satisfied = semver.satisfies(version, range); // true"
Coercion
This feature coerces a string to a semantic version if possible.
"const semver = require('semver');
const version = 'v1';
const coerced = semver.coerce(version); // '1.0.0'"
This package provides a simple way to compare version numbers. While semver offers a full suite of semantic versioning features, compare-versions focuses solely on the comparison aspect, making it a lighter alternative for this specific use case.
This is an alternative package that also implements the semantic versioning specification. It is similar to semver but may have different APIs or additional features.
This package is used to validate version numbers against the semantic versioning specification. Unlike semver, which offers a broad range of versioning utilities, validate-version is specifically tailored for validation.
$ npm install semver
semver.valid('1.2.3') // '1.2.3'
semver.valid('a.b.c') // null
semver.clean(' =v1.2.3 ') // '1.2.3'
semver.satisfies('1.2.3', '1.x || >=2.5.0 || 5.0.0 - 7.2.3') // true
semver.gt('1.2.3', '9.8.7') // false
semver.lt('1.2.3', '9.8.7') // true
As a command-line utility:
$ semver -h
Usage: semver -v <version> [-r <range>]
Test if version(s) satisfy the supplied range(s),
and sort them.
Multiple versions or ranges may be supplied.
Program exits successfully if any valid version satisfies
all supplied ranges, and prints all satisfying versions.
If no versions are valid, or ranges are not satisfied,
then exits failure.
Versions are printed in ascending order, so supplying
multiple versions to the utility will just sort them.
A version is the following things, in this order:
A leading "="
or "v"
character is stripped off and ignored.
The ordering of versions is done using the following algorithm, given two versions and asked to find the greater of the two:
2.3.4 > 1.3.4
2.3.4 > 2.2.4
2.3.4 > 2.3.3
2.3.4-0 > 2.3.4
2.3.4-10 > 2.3.4-9
2.3.4 > 2.3.4-beta
2.3.4-beta > 2.3.4-alpha
The following range styles are supported:
>1.2.3
Greater than a specific version.<1.2.3
Less than1.2.3 - 2.3.4
:= >=1.2.3 <=2.3.4
~1.2.3
:= >=1.2.3 <1.3.0
~1.2
:= >=1.2.0 <1.3.0
~1
:= >=1.0.0 <2.0.0
1.2.x
:= >=1.2.0 <1.3.0
1.x
:= >=1.0.0 <2.0.0
Ranges can be joined with either a space (which implies "and") or a
||
(which implies "or").
v1 > v2
v1 >= v2
v1 < v2
v1 <= v2
v1 == v2
This is true if they're logically equivalent,
even if they're not the exact same string. You already know how to
compare strings.v1 != v2
The opposite of eq."==="
and "!=="
do simple
string comparison, but are included for completeness. Throws if an
invalid comparison string is provided.FAQs
The semantic version parser used by npm.
The npm package semver receives a total of 339,779,698 weekly downloads. As such, semver popularity was classified as popular.
We found that semver demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.