Skip to content

Fix UnboundLocalError on single-clause npm version ranges#202

Open
arpitjain099 wants to merge 1 commit into
aboutcode-org:mainfrom
arpitjain099:chore/npm-range-single-clause
Open

Fix UnboundLocalError on single-clause npm version ranges#202
arpitjain099 wants to merge 1 commit into
aboutcode-org:mainfrom
arpitjain099:chore/npm-range-single-clause

Conversation

@arpitjain099

Copy link
Copy Markdown

While parsing native node-semver ranges I hit an internal crash on some wildcard inputs.

NpmVersionRange.from_native() sends tokens like >=1.x and *.x through get_npm_version_constraints_from_semver_npm_spec(). That helper only assigns anyof_constraints inside the isinstance(clause, (AnyOf, AllOf)) branch. When NpmSpec(...).clause.simplify() reduces to a single node-semver Range clause instead of an AnyOf/AllOf, execution falls straight through to the return, so a raw UnboundLocalError leaks out of the parser:

>>> from univers.version_range import NpmVersionRange
>>> NpmVersionRange.from_native(">=1.x")
UnboundLocalError: local variable 'anyof_constraints' referenced before assignment

>=1.x, *.x, >1.x and <=2.x all trip it, while ranges that expand to two bounds (1.x, 0.x, ~1.x, 1.2.x - 2.0.0) were fine because they simplify to an AllOf.

The fix flattens the branch and adds an explicit case for the single Range clause, building one VersionConstraint from its operator and target the same way get_allof_constraints does per constraint. Any other unexpected clause type now raises InvalidVersionRange rather than the old (unreachable) ValueError. Multi-clause handling is unchanged.

After the change:

>>> str(NpmVersionRange.from_native(">=1.x"))
'vers:npm/>=1.0.0'
>>> str(NpmVersionRange.from_native("*.x"))
'vers:npm/>=0.0.0'

Added parametrized tests in tests/test_version_range.py covering the previously-crashing single-clause inputs and confirming the multi-clause ranges still produce the same output. The full tests/test_version_range.py suite passes.

NpmVersionRange.from_native() routes wildcard tokens such as ">=1.x" and
"*.x" through get_npm_version_constraints_from_semver_npm_spec(). When
NpmSpec(...).clause.simplify() collapses to a single node-semver Range clause
(rather than an AnyOf or AllOf), the helper never bound anyof_constraints and
returned it, raising a raw UnboundLocalError out of the parser.

Handle the single Range clause by building one VersionConstraint from its
operator and target, and raise InvalidVersionRange for any other unexpected
clause type. Multi-clause ranges are unchanged.

Signed-off-by: arpitjain099 <arpitjain099@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant