Skip to content

refactor: replace semver with verkit#3061

Merged
danielroe merged 1 commit into
npmx-dev:mainfrom
sxzz:refactor/verkit
Jul 19, 2026
Merged

refactor: replace semver with verkit#3061
danielroe merged 1 commit into
npmx-dev:mainfrom
sxzz:refactor/verkit

Conversation

@sxzz

@sxzz sxzz commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

🔗 Linked issue

Related to e18e/ecosystem-issues#277

🧭 Context

npmx is an ESM Nuxt application that uses semantic-version operations in both client and server code. verkit provides a pure ESM, zero-runtime-dependency implementation with first-party TypeScript declarations, so it fits the project while removing the CommonJS semver package and its separate type package.

📚 Description

  • replace semver and @types/semver with verkit@0.1.2
  • migrate version parsing, comparison, range, prerelease, difference, and satisfying-version calls to the verkit APIs
  • preserve nullable parsing behavior with tryParse
  • update Vite dependency optimization and regenerate the pnpm lockfile

There should be no user-facing behavior change to version sorting, filtering, dependency resolution, or package analysis.

✅ Validation

  • pnpm lint:fix
  • pnpm test:types
  • 154 focused unit tests
  • 95 focused Nuxt tests
  • pnpm build

@vercel

vercel Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
docs.npmx.dev Ready Ready Preview, Comment Jul 19, 2026 8:36pm
npmx.dev Ready Ready Preview, Comment Jul 19, 2026 8:36pm
1 Skipped Deployment
Project Deployment Actions Updated (UTC)
npmx-lunaria Ignored Ignored Jul 19, 2026 8:36pm

Request Review

@coderabbitai

coderabbitai Bot commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Summary by CodeRabbit

  • Improvements
    • Updated version and dependency comparisons across the application for more consistent SemVer range validation, sorting, parsing and prerelease handling.
    • Improved handling of invalid version filters and dependency version resolution.
    • Preserved existing version browsing, outdated dependency analysis and package timeline behaviour while improving consistency across these features.

Walkthrough

The changes replace semver with verkit across dependency metadata, shared version utilities, client components and composables, and server-side dependency resolution and version processing.

Changes

Verkit SemVer migration

Layer / File(s) Summary
Dependency setup and core version utilities
package.json, pnpm-workspace.yaml, nuxt.config.ts, app/utils/versions.ts, app/utils/npm/outdated-dependencies.ts
Adds verkit, removes semver, updates dependency optimisation, and switches shared parsing, validation, range filtering, and outdated-dependency typing.
Client version and range consumers
app/components/..., app/composables/..., app/pages/..., app/utils/npm/api.ts, app/utils/publish-security.ts
Uses verkit for range validation, comparisons, prerelease handling, version sorting, outdated calculations, and major-version extraction.
Server dependency and download resolution
server/utils/...
Uses verkit for dependency diffing, fixed-version selection, satisfying-version resolution, prerelease filtering, parsing, and reverse sorting.

Suggested reviewers: 43081j

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarises the main change: replacing semver with verkit.
Description check ✅ Passed The description matches the changeset and accurately describes the verkit migration and related validation.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown

Hello! Thank you for opening your first PR to npmx, @sxzz! 🚀

Here’s what will happen next:

  1. Our GitHub bots will run to check your changes.
    If they spot any issues you will see some error messages on this PR.
    Don’t hesitate to ask any questions if you’re not sure what these mean!

  2. In a few minutes, you’ll be able to see a preview of your changes on Vercel

  3. One or more of our maintainers will take a look and may ask you to make changes.
    We try to be responsive, but don’t worry if this takes a few days.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedverkit@​0.1.27510010088100

View full report

@github-actions

Copy link
Copy Markdown

e18e dependency analysis

No dependency warnings found.

@codecov

codecov Bot commented Jul 19, 2026

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (2)
app/utils/versions.ts (1)

283-299: 🚀 Performance & Scalability | 🔵 Trivial

Consider using the normalised range for satisfies.

If normalizeRange(trimmed) returns a parsed or normalised range string, it may be more efficient or correct to pass the normalised result to satisfies rather than the raw trimmed string, to avoid duplicate parsing/normalisation inside satisfies.

♻️ Proposed refactor
 export function filterVersions(versions: string[], range: string): Set<string> {
   const trimmed = range.trim()
   if (trimmed === '') {
     return new Set(versions)
   }
 
-  if (!normalizeRange(trimmed)) {
+  const normalised = normalizeRange(trimmed)
+  if (!normalised) {
     return new Set()
   }
 
   const matched = new Set<string>()
   for (const v of versions) {
-    if (satisfies(v, trimmed, { includePrerelease: true })) {
+    if (satisfies(v, normalised, { includePrerelease: true })) {
       matched.add(v)
     }
   }
   return matched
 }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/utils/versions.ts` around lines 283 - 299, Update filterVersions to
retain the result of normalizeRange(trimmed) and pass that normalized range to
satisfies instead of the raw trimmed value, while preserving the existing
empty-range and invalid-range behavior.
app/composables/npm/useOutdatedDependencies.ts (1)

29-29: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Use an explicit null check for consistency.

While !getPrerelease(v) correctly filters out prereleases (assuming it returns a truthy value for prereleases and null for stable versions), using an explicit === null check improves clarity and aligns with the pattern used in useInstallSizeDiff.ts.

♻️ Proposed refactor
-    filteredVersions = versions.filter(v => !getPrerelease(v))
+    filteredVersions = versions.filter(v => getPrerelease(v) === null)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/composables/npm/useOutdatedDependencies.ts` at line 29, Update the
versions filter in the outdated-dependency flow to retain only entries where
getPrerelease(v) explicitly equals null, replacing the truthiness check while
preserving the existing prerelease filtering behavior and matching
useInstallSizeDiff.ts.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@app/composables/npm/useOutdatedDependencies.ts`:
- Line 29: Update the versions filter in the outdated-dependency flow to retain
only entries where getPrerelease(v) explicitly equals null, replacing the
truthiness check while preserving the existing prerelease filtering behavior and
matching useInstallSizeDiff.ts.

In `@app/utils/versions.ts`:
- Around line 283-299: Update filterVersions to retain the result of
normalizeRange(trimmed) and pass that normalized range to satisfies instead of
the raw trimmed value, while preserving the existing empty-range and
invalid-range behavior.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c29d7fed-f026-4611-bcbe-ff05c98b3328

📥 Commits

Reviewing files that changed from the base of the PR and between 1aba280 and d08a810.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (19)
  • app/components/Package/Versions.vue
  • app/components/VersionSelector.vue
  • app/composables/npm/useOutdatedDependencies.ts
  • app/composables/useCommandPaletteVersionCommands.ts
  • app/composables/useInstallSizeDiff.ts
  • app/pages/package-timeline/[[org]]/[packageName].vue
  • app/pages/package/[[org]]/[name]/versions.vue
  • app/utils/npm/api.ts
  • app/utils/npm/outdated-dependencies.ts
  • app/utils/publish-security.ts
  • app/utils/versions.ts
  • nuxt.config.ts
  • package.json
  • pnpm-workspace.yaml
  • server/utils/compare.ts
  • server/utils/dependency-analysis.ts
  • server/utils/dependency-resolver.ts
  • server/utils/npm.ts
  • server/utils/version-downloads.ts

@danielroe danielroe left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❤️

@danielroe
danielroe added this pull request to the merge queue Jul 19, 2026
Merged via the queue into npmx-dev:main with commit 7c506b5 Jul 19, 2026
26 checks passed
@github-actions

Copy link
Copy Markdown

Thanks for your first contribution, @sxzz! 🙌

We'd love to welcome you to the npmx community. Come and say hi on Discord! And once you've joined, visit npmx.wamellow.com to claim the contributor role.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants