Repository navigation
feat: resolve semver ranges in the version input - #459
Conversation
Accept npm semver ranges (^2.95, ~2.98.0, 2.x, >=2.98 <2.99, ^1 || ^2) and install the highest published version that satisfies them. Ranges are recognized by syntax so unknown words still fail, and npm resolves the range to an exact version before the existing install and GitHub release fallback run.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: beccaacca0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
avallete
left a comment
avallete
left a comment
There was a problem hiding this comment.
LGTM, not sure we wanna handle the finding of codex, leave it up to you Julien to decide if that's a legitimate case.
Pick npm's latest when it satisfies the range, otherwise the highest non-deprecated match, from a single npm view call, and install the exact verified version. Accept spaced operators and v prefixes in ranges, and only report a missing match when npm says no version matches.
Supabase's local ports fall inside Linux's ephemeral port range, so outbound connections during image pulls could hold one when supabase start binds it, failing with "address already in use" on ports like 54322 and 54324.
Summary
The
versioninput now accepts npm semver ranges and installs the highest published version that satisfies them:Supported forms are the ones npm understands: caret (
^2.95), tilde (~2.98.0), x-ranges (2.x,2.98.*,2), hyphen ranges (2.90.0 - 2.98.0), comparators (>=2.98 <2.99) and unions (^1 || ^2).How it works
isVersionRangerecognizes ranges by syntax, after the existing dist-tag,v<N>.stableand exact-version checks. Unknown words likecanaryorlasteststill fail with the unsupported-version error instead of reaching npm as dist-tags.npm view supabase@<range> version bin scripts dist.integrity deprecated dist-tags --jsonreturns the matching manifests. The action picks one the way npm's installer does:latestwhen it matches and isn't deprecated, otherwise the highest non-deprecated match, otherwise the highest match. It logsResolved Supabase CLI version "<range>" to <version>, then installs that exact verified version. The npm install and GitHub release fallback are unchanged.No match found for version, the action fails withNo published Supabase CLI version matches "<range>". If npm cannot resolve the range, there is no GitHub release fallback because no exact version is known, which is the same behavior as dist-tags.^2.95never selects a beta unless the range names a prerelease.>= 2.98 < 2.99) andv/Vprefixes in ranges are normalized before validation.Testing
bun run ciandbun run typecheckpass, including new integration tests for caret, x-range, comparator and single-match ranges, ranges with no match, npm failures, and rejected word-like inputs.~2.98.0resolved to 2.98.2 and installed from npm,canarywas rejected, and^99failed with the no-match error.^2entry to the e2e matrix.CI flake fix
supabase startin e2e intermittently failed withfailed to bind host port 0.0.0.0:54324: address already in use(5 failures onmainsince September, on 54322 and 54324). Supabase's local ports are inside Linux's ephemeral port range (32768-60999), so outbound connections during image pulls can hold one. The e2e job now reserves 54320-54329 withnet.ipv4.ip_local_reserved_portsbefore anything runs.Docs
@v3can still install older CLI majors (version: ^2), and it notes the Node.js/npm requirement and the changed default version.