{"action":"created","issue":{"url":"https://api.github.com/repos/nodesecurity/nsp/issues/70","labels_url":"https://api.github.com/repos/nodesecurity/nsp/issues/70/labels{/name}","comments_url":"https://api.github.com/repos/nodesecurity/nsp/issues/70/comments","events_url":"https://api.github.com/repos/nodesecurity/nsp/issues/70/events","html_url":"https://github.com/nodesecurity/nsp/issues/70","id":60858398,"number":70,"title":"Weird Semver error","user":{"login":"KyleAMathews","id":71047,"avatar_url":"https://avatars.githubusercontent.com/u/71047?v=3","gravatar_id":"","url":"https://api.github.com/users/KyleAMathews","html_url":"https://github.com/KyleAMathews","followers_url":"https://api.github.com/users/KyleAMathews/followers","following_url":"https://api.github.com/users/KyleAMathews/following{/other_user}","gists_url":"https://api.github.com/users/KyleAMathews/gists{/gist_id}","starred_url":"https://api.github.com/users/KyleAMathews/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KyleAMathews/subscriptions","organizations_url":"https://api.github.com/users/KyleAMathews/orgs","repos_url":"https://api.github.com/users/KyleAMathews/repos","events_url":"https://api.github.com/users/KyleAMathews/events{/privacy}","received_events_url":"https://api.github.com/users/KyleAMathews/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-03-12T17:24:03Z","updated_at":"2015-03-12T22:44:18Z","closed_at":null,"body":"I'm getting this error when running `nsp audit-package`\r\n\r\n```\r\n/usr/lib/node_modules/nsp/node_modules/semver/semver.js:273\r\n    throw new TypeError('Invalid Version: ' + version);\r\n          ^\r\nTypeError: Invalid Version: 3.11.01\r\n    at new SemVer (/usr/lib/node_modules/nsp/node_modules/semver/semver.js:273:11)\r\n    at compare (/usr/lib/node_modules/nsp/node_modules/semver/semver.js:460:10)\r\n    at gte (/usr/lib/node_modules/nsp/node_modules/semver/semver.js:509:10)\r\n    at cmp (/usr/lib/node_modules/nsp/node_modules/semver/semver.js:526:22)\r\n    at Comparator.test (/usr/lib/node_modules/nsp/node_modules/semver/semver.js:599:10)\r\n    at testSet (/usr/lib/node_modules/nsp/node_modules/semver/semver.js:922:17)\r\n    at Range.test (/usr/lib/node_modules/nsp/node_modules/semver/semver.js:914:9)\r\n    at satisfies (/usr/lib/node_modules/nsp/node_modules/semver/semver.js:935:16)\r\n    at /usr/lib/node_modules/nsp/node_modules/semver/semver.js:941:12\r\n    at Array.filter (native)\r\n    at Function.maxSatisfying (/usr/lib/node_modules/nsp/node_modules/semver/semver.js:940:19)\r\n    at /usr/lib/node_modules/nsp/lib/auditPackage.js:167:22\r\n    at saved (/usr/lib/node_modules/nsp/node_modules/silent-npm-registry-client/node_modules/npm-registry-client/lib/get.js:142:7)\r\n```\r\n\r\nI don't have any packages with a version 3.11.01 and grepping for all package.jsons in my node_modules finds nothing either."},"comment":{"url":"https://api.github.com/repos/nodesecurity/nsp/issues/comments/78669390","html_url":"https://github.com/nodesecurity/nsp/issues/70#issuecomment-78669390","issue_url":"https://api.github.com/repos/nodesecurity/nsp/issues/70","id":78669390,"user":{"login":"sverweij","id":4822597,"avatar_url":"https://avatars.githubusercontent.com/u/4822597?v=3","gravatar_id":"","url":"https://api.github.com/users/sverweij","html_url":"https://github.com/sverweij","followers_url":"https://api.github.com/users/sverweij/followers","following_url":"https://api.github.com/users/sverweij/following{/other_user}","gists_url":"https://api.github.com/users/sverweij/gists{/gist_id}","starred_url":"https://api.github.com/users/sverweij/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sverweij/subscriptions","organizations_url":"https://api.github.com/users/sverweij/orgs","repos_url":"https://api.github.com/users/sverweij/repos","events_url":"https://api.github.com/users/sverweij/events{/privacy}","received_events_url":"https://api.github.com/users/sverweij/received_events","type":"User","site_admin":false},"created_at":"2015-03-12T22:44:18Z","updated_at":"2015-03-12T22:44:18Z","body":"Seems this is what happens: auditPackage.js retrieves all versions for a package and asks server to get the \"max satisfying\". Trouble is that the collection of all versions can contain version numbers that don't satisfy semantic versioning (3.11.01 apparently, or - in my case 1.0.2beta for handlebars.js). Which makes semver barf. This is happening on line 167 - 169:\r\n```javascript\r\n                var ver = semver\r\n                    .maxSatisfying(Object.keys(dependencyPkginfo.versions),\r\n                                               dependencyVersion);\r\n\r\n```\r\n\r\nA short term solution could be to filter out the non semantic versions before passing them to maxSatisfying. like this:\r\n```javascript\r\n                var ver = semver\r\n                    .maxSatisfying(Object.keys(dependencyPkginfo.versions)\r\n                                                .filter(function(pVersion){\r\n                                                    return semver.valid(pVersion);\r\n                                                }),\r\n                                               dependencyVersion);\r\n```\r\nI've tested this locally and it makes the error go away. \r\n\r\nIt will introduce a new problem, though, when it is possible to get npm to install non-semantically versioned module versions (*--> is this scenario possible???*):\r\n- package.json has version _^1.0.0_ for a module \r\n- the npm registry contains _1.0.1beta_ (or otherwise non-semver)\r\n- ```npm install``` yields _1.0.1beta_ getting installed\r\n\r\n_nsp_ would then have scanned 1.0.0, and not the _1.0.1beta_, which is actually used. And may contain malicious side-effects.\r\n\r\nIf this is indeed possible some creativity is still in order (otherwise I'm happy to provide a pull request over the weekend :-))"}}