Skip to content

🐛 fix(spec): exclude boundary prereleases - #217

Merged
gaborbernat merged 2 commits into
tox-dev:mainfrom
gaborbernat:bug/aqa61m67-prerelease-bounds
Nov 3, 2026
Merged

gaborbernat merged 2 commits into
tox-dev:mainfrom
gaborbernat:bug/aqa61m67-prerelease-bounds

Conversation

@gaborbernat

@gaborbernat gaborbernat commented Nov 3, 2026 •

Copy link
Copy Markdown
Member

A request bounded by <3.12.0 could select Python 3.12.0rc1: the exclusive comparison accepted versions that sort below the final release. Discovery now excludes prereleases of the release named by a final upper bound. Fixes #189.

Exclusive upper bounds

The version specifier standard excludes a prerelease of the release named by <, even though that prerelease sorts before the final version. The new comparison applies that rule when the candidate and final bound share a release number.

Behavior changes

<3.12 and <3.12.0 exclude 3.12.0rc1. An explicit prerelease bound such as <3.12.0rc2 still accepts 3.12.0rc1; <=3.12.0 keeps its inclusive comparison.

Reported by Anthropic's OSS Scanner: ANT-2026-AQA61M67.

@gaborbernat gaborbernat added the bug Something isn't working label Nov 3, 2026
@gaborbernat
gaborbernat merged commit e2745e2 into tox-dev:main Nov 3, 2026
20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Upper version bounds admit the next release's prereleases

1 participant