ljharb/ls-engines

Improper handling of OR ( || ) allows invalid result

开放

#32 创建于 2025年1月16日

 (2 条评论) (2 个反应) (0 位负责人)JavaScript (4 个派生)github user discovery
bughelp wanted

仓库指标

星标
 (56 个星标)
PR 合并指标
 (30 天内没有已合并 PR)

描述

Hello,

I have a project for which I'm trying to use ls-engines to identify the minimum node version for and upon inspecting the requirements myself I ran into a notable edge case that I'm not sure about the choices for:

Upon inspection, the minimatch package had the most recent engine requirement, stating 20 || >= 22. Notably, this explicitly excludes node version 21. However, the result of ls-engines produces >= 20 as the result, which will erroneously accept version 21.

I believe the desired behavior should be to either inherit the same requirement as minimatch in this case, or just default to the highest of the specified values (>=22). Practically speaking wrt implementation, it may make sense to track which versions are excluded by dependencies to validate the output does not conflict.

贡献者指南