ljharb/ls-engines

Improper handling of OR ( || ) allows invalid result

Aperta

#32 aperta il 16 gen 2025

 (2 commenti) (2 reazioni) (0 assegnatari)JavaScript (4 fork)github user discovery
bughelp wanted

Metriche repository

Star
 (57 stelle)
Metriche merge PR
 (Nessuna PR mergiata in 30 g)

Descrizione

Hello,

I have a project for which I'm trying to use ls-engines to identify the minimum node version for and upon inspecting the requirements myself I ran into a notable edge case that I'm not sure about the choices for:

Upon inspection, the minimatch package had the most recent engine requirement, stating 20 || >= 22. Notably, this explicitly excludes node version 21. However, the result of ls-engines produces >= 20 as the result, which will erroneously accept version 21.

I believe the desired behavior should be to either inherit the same requirement as minimatch in this case, or just default to the highest of the specified values (>=22). Practically speaking wrt implementation, it may make sense to track which versions are excluded by dependencies to validate the output does not conflict.

Guida contributor