Source: PR #1447, head f5b6545ff2db4cca7a79e5a192de0a58a9d4a817 (triage-deferred review finding).
Severity: low.
Where: test/core/hyparquet-floor-pin.test.js, dedupeOffenders, the isValidRange "cannot judge" branch (around line 357 at that head).
Evidence and behavior: src/core/semver.js supports only ^ ~ >= > <= < = * on a full X.Y.Z, with no ||, hyphen, x-range, or compound-range support. A read-path dependency declaring a shape npm would dedupe cleanly onto the root pin (for example >=1.28.0 <2.0.0, ^1.29.0 || ^2.0.0, 1.29.x) fails isValidRange and reddens the suite with the "a range shape this check cannot judge ... read it before trusting either answer" message. This is a residue of the false-red class issue #1446 removed, restricted to a narrower set of shapes.
Why deferring is safe: it is the conservative half of the trade. The failure mode is a loud, self-describing test red, never a false green, and it matches the convention atOrAboveFloor / lowestVersion already apply in the same file ("an unfamiliar shape gets looked at rather than waved through"). No dependency in the current tree declares such a shape, so nothing reddens today. Closing it properly needs a real range parser, which the no-new-runtime-dependencies rule argues against for a hypothetical.
Acceptance: either (a) a read-path dependency ships a compound/||/x/hyphen range and the check is taught to judge it (the synthetic test a declaration dedupes when the root pin satisfies it, not when it matches it then asserts that shape dedupes instead of asserting cannot judge), or (b) the issue is closed as won't-fix if the situation never arises.
Source: PR #1447, head
f5b6545ff2db4cca7a79e5a192de0a58a9d4a817(triage-deferred review finding).Severity: low.
Where:
test/core/hyparquet-floor-pin.test.js,dedupeOffenders, theisValidRange"cannot judge" branch (around line 357 at that head).Evidence and behavior:
src/core/semver.jssupports only^ ~ >= > <= < = *on a fullX.Y.Z, with no||, hyphen,x-range, or compound-range support. A read-path dependency declaring a shape npm would dedupe cleanly onto the root pin (for example>=1.28.0 <2.0.0,^1.29.0 || ^2.0.0,1.29.x) failsisValidRangeand reddens the suite with the "a range shape this check cannot judge ... read it before trusting either answer" message. This is a residue of the false-red class issue #1446 removed, restricted to a narrower set of shapes.Why deferring is safe: it is the conservative half of the trade. The failure mode is a loud, self-describing test red, never a false green, and it matches the convention
atOrAboveFloor/lowestVersionalready apply in the same file ("an unfamiliar shape gets looked at rather than waved through"). No dependency in the current tree declares such a shape, so nothing reddens today. Closing it properly needs a real range parser, which the no-new-runtime-dependencies rule argues against for a hypothetical.Acceptance: either (a) a read-path dependency ships a compound/
||/x/hyphen range and the check is taught to judge it (the synthetic testa declaration dedupes when the root pin satisfies it, not when it matches itthen asserts that shape dedupes instead of assertingcannot judge), or (b) the issue is closed as won't-fix if the situation never arises.