semver
7.8.5 · 19 Jun 2026ISC750.1M / weekRepositoryHomepagenpmAtom feed
Upgrading semver from 5.0.3 to 7.8.5
59 releases in betweennotes for 31
Counted from 31 of 59 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking7.0.0
Security
Fixes 1 advisory affecting 5.0.3
- semver vulnerable to Regular Expression Denial of Servicehigh · GHSA-c2qf-rxjj-qqgw
Release by release
- fixed
Include prereleases in tilde range lower bound with includePrerelease
- fixed
- fixed
Reject numeric segments after x-ranges
- fixed
- fixed
Align caret includePrerelease lower bounds
- fixed
- fixed
Increment dotted prerelease identifiers (#870) (@liuzemei, @SheldonNeo)
- fixed
- fixed
Strip build metadata before comparator trimming
- fixed
Handle prerelease bounds in subset (#867) (@puneetdixit200, Puneet Dixit)
- fixed
- new
Add
truncatefunction (#855) (@pjohnmeyer, @owlstronaut) - fixed
Warn when defaulting to --inc=patch in CLI
- new
- fixed
cli: Pass options to semver.valid() for loose version validation
- fixed
- fixed
Faster paths for compare
- fixed
x-range build metadata support (i529015)
- fixed
3 other lines we could not sort, mostly version bumps
- 7.1.2
Remove fancy lazy-loading logic, as it was causing problems for webpack
- 7.0.0
Refactor module into separate files for better tree-shaking
- 6.2.0
Coerce numbers to strings when passed to semver.coerce()
44 internal lines (docs, tests, tooling) left out.