SemVer versioning: how we handled it with linear interval arithmetic

Semantic versioning (SemVer) is widely regarded as the standard for tracking software version states, although in practice, many ecosystems have developed their own dialects, complicating automation in dependency scanning and vulnerability assessments. GitLab's Dependency Scanning (DS) feature identifies software vulnerabilities using these diverse SemVer dialects, leveraging the GitLab Advisory Database, which is updated daily. The fragmentation of SemVer has necessitated the creation of semver_dialects, a tool that processes semantic versions generically and language-independently, facilitating automated advisory generation. This tool, now open-sourced, employs linear interval arithmetic to normalize and compare semantic versions across different ecosystems, simplifying the management of version constraints. Through semver_dialects, GitLab enhances its ability to automate the generation of advisories by translating native semantic version constraints into a common representation, thus improving efficiency in identifying non-affected versions and providing remediation information for vulnerable packages.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.