Skip to content

Increment long numeric prerelease and build identifiers without integer conversion - #496

Open
machines-6657 wants to merge 1 commit into
python-semver:masterfrom
machines-6657:codex/overflow-safe-semver-bumps
Open

machines-6657 wants to merge 1 commit into
python-semver:masterfrom
machines-6657:codex/overflow-safe-semver-bumps

Conversation

@machines-6657

Copy link
Copy Markdown

Summary

Version.parse() accepts a valid 5000-digit numeric prerelease or build
identifier, but bump_prerelease() and bump_build() raise ValueError under
Python's default integer-string conversion limit. Increment ASCII decimal
strings directly rather than converting them to integers.

Preserve existing constructor normalization of prerelease leading zeros,
build padding, Unicode digit handling and input immutability. The process-wide
integer conversion limit is left unchanged.

Validation

  • Actual base regressions: 5 expected failures and 6 passing controls.
  • Full Windows Python 3.11.9 suite: 482 passed, 1 optional-native-backend skip;
    100% statement and branch coverage.
  • Independent comparison: 20,412 existing-behavior cases match the base.
  • New regression module passes Ruff lint and formatting. Complete repository
    Ruff results remain at the same 160 inherited findings; no added occurrences.
    Upstream marks that check nonblocking. Configured mypy still reports the
    optional backend's missing typing information; docformatter still reports
    existing formatting differences. Neither is claimed to pass.
  • The full supported-interpreter, native-backend, documentation and packaging
    matrices have not been run. A numbered newsfragment is deferred until a PR
    number exists, following the project's post-PR changelog instructions.

AI assistance disclosure: OpenAI Codex assisted with investigation,
implementation, regressions and independent baseline verification under the
contributor's authorization.

@tomschr

tomschr commented Oct 18, 2026

Copy link
Copy Markdown
Member

Thank you @machines-6657 for the contribution.

The string-based digit comparison and increment logic (_nat_cmp and _increment_digits) is a great improvement over quadratic int() conversion. 👍

In regards to the 5,000 digit, this scenario is unrealistic:

  • No production software or package ecosystem intentionally uses a 5,000 digit version number of prerelease tag.

  • The Semantic Versioning 2.0.0 FAQ addresses this directly:

    "Is there a maximum length of a version string? No, but use good judgment. A 255 character version string is probably overkill, for example."

In line with the SemVer FAQ and general defense-in-depth against resource abuse, I'd like to enforce a sensible upper bound of 512 characters on version strings via MAX_VERSION_LENGTH = 512. This could be implemented as a class variable.

Could you adjust the tests so that:

  1. The digit-increment and comparison logic is tested against long numbers within the cap (e.g., 200–400 digits).
  2. Inputs exceeding MAX_VERSION_LENGTH (such as 513+ characters) verify that ValueError is raised?

That gives us both the efficiency of your string-based algorithm and a clean guard against excessively large inputs.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants