Major version constraint circumvented by prerelease versions

[mattolenik]

I'm trying to implement a range check that allows any major or minor version change, but never a major change. So that anything starting with 1 but never anything starting with 2 or above.

I tried expressing that as >= 1.x, >= 1.x < 2.x, >= 1.x < 2.x.x, and >= 1.x < 2.0.0, but found that it will allow 2.x prereleases, e.g. 2.0.0-v2-5.

package main

import (
	"fmt"
	"github.com/blang/semver/v4"
)

func main() {
	v, _ := semver.Parse("2.0.0-v2-5")
	r, _ := semver.ParseRange(">= 1.x")
	fmt.Println(r(v))
	r, _ = semver.ParseRange(">= 1.x < 2.x")
	fmt.Println(r(v))
	r, _ = semver.ParseRange(">= 1.x < 2.x.x")
	fmt.Println(r(v))
	r, _ = semver.ParseRange(">= 1.x < 2.0.0")
	fmt.Println(r(v))
}

This prints true four times. I know that 2.0.0-v2-5 is "less than" 2.0.0 because it is a prerelease, but this seems to be making it caught by 1.x as well.