fix(version): compare SemVer prereleases correctly

[dipeshbabu]

Summary

• compare prerelease versions identifier by identifier according to SemVer precedence
• compare numeric identifiers numerically and below nonnumeric identifiers
• account for differing prerelease identifier counts and ASCII ordering
• add the standard SemVer precedence sequence and the previously misordered alpha.1/alpha-1 case as regression coverage

Root cause

The update notifier compared each complete prerelease string with Intl.Collator. Locale-aware comparison does not implement SemVer's identifier boundaries or precedence rules, so valid versions such as 1.0.0-alpha-1 and 1.0.0-alpha.1 could be ordered incorrectly.

Impact

Prerelease users receive update notices only when the registry version has higher SemVer precedence. Stable-version behavior is unchanged.

Overlap check

Before publishing, open issues and pull requests were reviewed and repository-wide searches were run for semver, prerelease, update notice, and version comparison. No active issue or pull request overlaps this fix. The only related search hits were already-merged work that introduced the broader update-notice and release features.

Validation

• pnpm dlx bun test --timeout 30000 ./tests-ts/update-notice.test.ts — 10 passed
• pnpm exec tsc --noEmit
• pnpm exec prettier --check src/version.ts tests-ts/update-notice.test.ts
• git diff --check

[mldangelo-oai]

@codex review Please review exact head 9d27268, focusing on SemVer prerelease precedence, numeric versus lexical identifiers, oversized identifiers, stable releases, and compatibility with the current-main merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9d2726817f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject leading-zero numeric prerelease identifiers

When a custom or malformed registry returns 1.0.0-alpha.01 for an installation at 1.0.0-alpha.1, VERSION_PATTERN accepts the candidate and this length comparison reports it as newer. SemVer forbids leading zeroes in numeric prerelease identifiers, so an invalid registry version can now produce an update notice instead of being ignored; validate prerelease identifiers before applying the length-based numeric comparison.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 9d2726817f

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.