protocolbuffers/protobuf

[Ruby] pre-release versions (eg: 4.29.0.rc.2) are not semver compatible

Closed this issue · 7 comments

google-protobuf gems do not use valid semver to identify pre-release candidates. 4.29.0.rc.2 should be 4.29.0-rc.2

Ruby gems should follow semver. Dependabot and other CI tooling automatically filter out pre-release candidates when performing maintennce. However, google-protobuf releases are missing the - character after the patch version which would identify pre-releases. This causes pre-mature upgrade proposals by these tools.

<valid semver> ::= <version core>
                 | <version core> "-" <pre-release>
                 | <version core> "+" <build>
                 | <version core> "-" <pre-release> "+" <build>

@colinbendell - am I correct in my understanding (based on a review of google-protobuf gems's historical releases) that this is a feature request to package the gem using a Semver compatible naming scheme, rather than a regression in the most recent RC? So far as I can tell, the naming scheme in use for this RC has been used consistently since the Protobuf ruby gem's initial release.

It's a long standing bug. It's routinely caused dependabot to falsely attempt to upgrade rc versions.

Where is the version migration script located? I looked to propose a PR but couldn't find it.

I think it is maintained internally as part of a larger mechanism for releasing all supported languages at once. Let me confirm and get back to you on this point later this week.

We discussed this today and will make the fix for the 30.x RC's.

We had originally kept the dots in the rc versions after seeing this documentation on ruby's website:
image and a few other ruby gems that used the same naming scheme.

Do you know anything about this discrepancy?

@deannagarcia, it looks like you are correct. After further investigation, semver -beta3 notation is converted to .pre.beta3 by rubygems.

I'm going to close this issue as it looks like this is a dependabot bug.