vers 1.2.1 → 1.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f5112d8afb101f4e731fc66f0e7705d43653cc07b39cb1a6a92a96f4c4aa5a52
-  data.tar.gz: ee0a1ba110cd1f5638199ba4420397ba764e2fae1d4ddc6965c82ea0a4f2ae56
+  metadata.gz: 9a8066da910f228939dadbc96afeadcf5122c99ed9a06a67b9858c4720d7e070
+  data.tar.gz: 59204f511b9adfb7863d97f754915fe96725093e6f0fa4dc7bfc3f2703e5e387
 SHA512:
-  metadata.gz: 160685ee9b06f49753fa6ea6d91629657c0e019e466c8c8934e1214113b23193a5013dd9340eda9a51a966c476d3a9691877cabadb9b4f868a29598aa45a33de
-  data.tar.gz: 84df10d98802dbe190898b62bfe037f11802915993605141fe119fa9cd84d38bf0ec28f470b0bae620c8c4327c1d7e8336bb679e14b186c0707f6f22b135c3db
+  metadata.gz: e4af64390c9efd167082d891eb192f051a04e231a889e751a646e7ce93d55d5736c5f98368ca1b83b6e4adaebc7f962ce4282155eabc245c522ed142a63dda27
+  data.tar.gz: 119edf96cc65e3fc88d2f89b543ecbae593c6afeb136db0144793c981999476925ae5c671508965676b4d31d2a2cf1d4858feaaab45f443110561a5b74c00b06

data/Rakefile

@@ -187,74 +187,122 @@ namespace :benchmark do
   task :memory do
     require "benchmark"
     require "json"
+    require "objspace"
     require_relative "lib/vers"
-    
-    puts "💾 VERS Memory Usage Benchmarks"
+
+    puts "VERS Memory & Allocation Benchmarks"
     puts "=" * 50
-    
-    # Load sample ranges
+
     test_data_file = File.join(__dir__, "test-suite-data.json")
-    
+
     unless File.exist?(test_data_file)
-      puts "❌ test-suite-data.json not found. Using fallback examples."
+      puts "test-suite-data.json not found. Using fallback examples."
       sample_ranges = [
-        { input: "^1.2.3", scheme: "npm" },
-        { input: "~> 1.2", scheme: "gem" },
-        { input: ">=1.0,<2.0", scheme: "pypi" }
+        { "input" => "^1.2.3", "scheme" => "npm" },
+        { "input" => "~> 1.2", "scheme" => "gem" },
+        { "input" => ">=1.0,<2.0", "scheme" => "pypi" }
       ]
     else
       test_data = JSON.parse(File.read(test_data_file))
       sample_ranges = test_data.select { |data| !data["is_invalid"] }.first(100)
     end
-    
-    puts "📊 Testing with #{sample_ranges.length} version ranges"
+
+    puts "Sample size: #{sample_ranges.length} version ranges"
     puts
-    
-    # Parse all ranges and store objects
-    puts "🔍 Parsing and storing #{sample_ranges.length} VersionRange objects..."
+
+    # Measure object allocations during cold parsing (no cache)
+    Vers::Version.class_variable_set(:@@version_cache, {})
+    Vers::Constraint.class_variable_set(:@@constraint_cache, {})
+    Vers::Parser.class_variable_set(:@@parser_cache, {})
+
+    GC.start
+    GC.disable
+    before = ObjectSpace.count_objects.dup
+
     version_ranges = []
-    
-    parsing_time = Benchmark.realtime do
-      sample_ranges.each do |range|
-        begin
-          parsed = Vers.parse_native(range['input'], range['scheme'])
-          version_ranges << parsed
-        rescue
-          # Skip invalid ranges
-        end
-      end
+    sample_ranges.each do |range|
+      parsed = Vers.parse_native(range['input'], range['scheme']) rescue nil
+      version_ranges << parsed if parsed
     end
-    
-    puts "   Parsing completed in #{(parsing_time * 1000).round(2)}ms"
-    puts "   Successfully parsed #{version_ranges.length} ranges"
+
+    after = ObjectSpace.count_objects
+    GC.enable
+
+    string_alloc = after[:T_STRING] - before[:T_STRING]
+    array_alloc = after[:T_ARRAY] - before[:T_ARRAY]
+    hash_alloc = after[:T_HASH] - before[:T_HASH]
+    object_alloc = after[:T_OBJECT] - before[:T_OBJECT]
+    match_alloc = (after[:T_MATCH] || 0) - (before[:T_MATCH] || 0)
+    total_alloc = string_alloc + array_alloc + hash_alloc + object_alloc + match_alloc
+
+    puts "Cold parse allocations (#{version_ranges.length} ranges, no cache):"
+    puts "   Total objects:  #{total_alloc}"
+    puts "   Strings:        #{string_alloc}"
+    puts "   Arrays:         #{array_alloc}"
+    puts "   Hashes:         #{hash_alloc}"
+    puts "   Objects:        #{object_alloc}"
+    puts "   MatchData:      #{match_alloc}"
+    puts "   Per range:      #{(total_alloc.to_f / version_ranges.length).round(1)}"
     puts
-    
-    # Estimate memory usage
-    estimated_memory = version_ranges.length * 300  # ~300 bytes per VersionRange object estimate
-    puts "💾 Memory Usage Estimation:"
-    puts "   #{version_ranges.length} VersionRange objects: ~#{estimated_memory} bytes"
-    puts "   Average per object: ~300 bytes"
+
+    # Measure cached parse allocations (everything already cached)
+    GC.start
+    GC.disable
+    before = ObjectSpace.count_objects.dup
+
+    sample_ranges.each do |range|
+      Vers.parse_native(range['input'], range['scheme']) rescue nil
+    end
+
+    after = ObjectSpace.count_objects
+    GC.enable
+
+    cached_strings = after[:T_STRING] - before[:T_STRING]
+    cached_arrays = after[:T_ARRAY] - before[:T_ARRAY]
+    cached_objects = after[:T_OBJECT] - before[:T_OBJECT]
+    cached_match = (after[:T_MATCH] || 0) - (before[:T_MATCH] || 0)
+    cached_alloc = cached_strings + cached_arrays + cached_objects + cached_match
+
+    puts "Cached parse allocations (#{version_ranges.length} ranges, warm cache):"
+    puts "   Total objects:  #{cached_alloc}"
+    puts "   Strings:        #{cached_strings}"
+    puts "   MatchData:      #{cached_match}"
+    puts "   Per range:      #{(cached_alloc.to_f / version_ranges.length).round(1)}"
     puts
-    
-    # Test repeated operations
-    puts "🔄 Repeated Operations Test:"
-    
+
+    # Measure memory size of retained objects
+    total_memsize = version_ranges.sum { |r| ObjectSpace.memsize_of(r) }
+    puts "Retained memory:"
+    puts "   #{version_ranges.length} VersionRange objects: #{total_memsize} bytes"
+    puts "   Average per object: #{(total_memsize.to_f / version_ranges.length).round(0)} bytes"
+    puts
+
+    # Repeated operation allocations
+    puts "Repeated operation allocations (#{version_ranges.length} calls each):"
+
     operations = {
-      "to_s conversion" => proc { version_ranges.each(&:to_s) },
-      "contains? check" => proc { version_ranges.each { |r| r.contains?("1.5.0") } },
-      "empty? check" => proc { version_ranges.each(&:empty?) },
-      "unbounded? check" => proc { version_ranges.each(&:unbounded?) }
+      "to_s" => proc { version_ranges.each(&:to_s) },
+      "contains?" => proc { version_ranges.each { |r| r.contains?("1.5.0") } },
+      "empty?" => proc { version_ranges.each(&:empty?) },
     }
-    
-    operations.each do |op_name, op_proc|
-      time = Benchmark.realtime { op_proc.call }
-      ops_per_second = version_ranges.length / time
-      
-      puts "   #{op_name.ljust(20)}: #{(time * 1000).round(2)}ms (#{ops_per_second.round(0)} ops/sec)"
+
+    operations.each do |name, op|
+      # Warm up
+      op.call
+
+      GC.start
+      GC.disable
+      before = ObjectSpace.count_objects.dup
+      op.call
+      after = ObjectSpace.count_objects
+      GC.enable
+
+      allocs = [:T_STRING, :T_ARRAY, :T_OBJECT, :T_MATCH, :T_HASH].sum { |k| (after[k] || 0) - (before[k] || 0) }
+      puts "   #{name.ljust(15)}: #{allocs} allocations"
     end
-    
+
     puts
-    puts "✅ Memory benchmark completed!"
+    puts "Memory benchmark completed!"
   end
   
   desc "Run complexity stress tests"

data/lib/vers/constraint.rb

@@ -23,7 +23,7 @@ module Vers
     
     # Cache for parsed constraints
     @@constraint_cache = {}
-    @@cache_size_limit = 500
+    @@cache_size_limit = 1000
 
     attr_reader :operator, :version
 
@@ -54,14 +54,19 @@ module Vers
     #   Vers::Constraint.parse("!=2.0.0")  # => #<Vers::Constraint:0x... @operator="!=", @version="2.0.0">
     #
     def self.parse(constraint_string)
-      # Limit cache size to prevent memory bloat
-      if @@constraint_cache.size >= @@cache_size_limit
-        @@constraint_cache.clear
+      # Bound input length before cache lookup so oversized strings never
+      # become cache keys and never trigger eviction.
+      if constraint_string.length > Version::MAX_LENGTH
+        raise ArgumentError, "Constraint string too long (#{constraint_string.length} > #{Version::MAX_LENGTH})"
       end
-      
-      # Return cached constraint if available
+
       return @@constraint_cache[constraint_string] if @@constraint_cache.key?(constraint_string)
-      
+
+      if @@constraint_cache.size >= @@cache_size_limit
+        keys = @@constraint_cache.keys
+        keys.first(keys.size / 2).each { |k| @@constraint_cache.delete(k) }
+      end
+
       constraint = parse_uncached(constraint_string)
       @@constraint_cache[constraint_string] = constraint
       constraint

data/lib/vers/interval.rb

@@ -12,8 +12,7 @@ module Vers
       @min_inclusive = min_inclusive
       @max_inclusive = max_inclusive
       @scheme = scheme
-
-      validate_bounds!
+      @empty = compute_empty
     end
 
     def self.empty(scheme: nil)
@@ -37,9 +36,7 @@ module Vers
     end
 
     def empty?
-      return true if min && max && version_compare(min, max) > 0
-      return true if min && max && version_compare(min, max) == 0 && (!min_inclusive || !max_inclusive)
-      false
+      @empty
     end
 
     def unbounded?
@@ -180,7 +177,22 @@ module Vers
 
     def overlaps?(other)
       return false if empty? || other.empty?
-      !intersect(other).empty?
+      return true if unbounded? || other.unbounded?
+
+      # Check if the intervals can't overlap by comparing bounds directly
+      if max && other.min
+        cmp = version_compare(max, other.min)
+        return false if cmp < 0
+        return false if cmp == 0 && (!max_inclusive || !other.min_inclusive)
+      end
+
+      if min && other.max
+        cmp = version_compare(min, other.max)
+        return false if cmp > 0
+        return false if cmp == 0 && (!min_inclusive || !other.max_inclusive)
+      end
+
+      true
     end
 
     def adjacent?(other)
@@ -211,14 +223,12 @@ module Vers
 
     private
 
-    def validate_bounds!
-      return unless min && max
-      
-      comparison = version_compare(min, max)
-      if comparison > 0
-        return
-      elsif comparison == 0 && (!min_inclusive || !max_inclusive)
-        return
+    def compute_empty
+      if min && max
+        cmp = version_compare(min, max)
+        cmp > 0 || (cmp == 0 && (!min_inclusive || !max_inclusive))
+      else
+        false
       end
     end
 

data/lib/vers/parser.rb

@@ -26,10 +26,24 @@ module Vers
     NPM_HYPHEN_REGEX = /\A(.+?)\s+-\s+(.+)\z/
     NPM_X_RANGE_MAJOR_REGEX = /\A(\d+)\.x\z/
     NPM_X_RANGE_MINOR_REGEX = /\A(\d+)\.(\d+)\.x\z/
+    OPERATOR_PREFIX_REGEX = /\A[><=!]+/
     
     # Cache for parsed ranges to improve performance
     @@parser_cache = {}
-    @@cache_size_limit = 200
+    @@cache_size_limit = 500
+
+    # Maximum accepted length for a range string at parse/parse_native
+    # entry points. Range strings concatenate multiple constraints so this
+    # is set higher than Version::MAX_LENGTH while still bounding
+    # split/regex work to a few KB.
+    MAX_INPUT_LENGTH = 2048
+
+    # Maximum number of |-separated or ||-separated constraints in a
+    # single range. The exclusion loop in parse_constraints does
+    # O(n^2 log n) work as each != splits an interval and reconstructs the
+    # range; capping n keeps the worst case under a few thousand interval
+    # operations.
+    MAX_CONSTRAINTS = 64
 
     ##
     # Parses a vers URI string into a VersionRange
@@ -46,6 +60,8 @@ module Vers
     #   parser.parse("vers:pypi/==1.2.3")
     #
     def parse(vers_string)
+      validate_input_length!(vers_string)
+
       if vers_string == "*"
         return VersionRange.unbounded
       end
@@ -74,6 +90,8 @@ module Vers
     #   parser.parse_native(">=1.0,<2.0", "pypi")
     #
     def parse_native(range_string, scheme)
+      validate_input_length!(range_string)
+
       case scheme
       when "npm"
         parse_npm_range(range_string)
@@ -150,14 +168,25 @@ module Vers
 
     private
 
+    def validate_input_length!(input)
+      return if input.nil?
+      return if input.length <= MAX_INPUT_LENGTH
+      raise ArgumentError, "Range string too long (#{input.length} > #{MAX_INPUT_LENGTH})"
+    end
+
     def sort_key_for_constraint(constraint)
-      version = constraint.sub(/\A[><=!]+/, '')
+      version = constraint.sub(OPERATOR_PREFIX_REGEX, '')
       v = Version.cached_new(version)
       [v, constraint]
     end
 
     def parse_constraints(constraints_string, scheme)
-      constraint_strings = constraints_string.split(/[|,]/)
+      # Limit constraint count to bound the O(n^2 log n) exclusion loop
+      # below: each != splits an interval and reconstructs the range.
+      constraint_strings = constraints_string.split(/[|,]/, MAX_CONSTRAINTS + 1)
+      if constraint_strings.length > MAX_CONSTRAINTS
+        raise ArgumentError, "Too many constraints (> #{MAX_CONSTRAINTS})"
+      end
       intervals = []
       exclusions = []
       interval_scheme = %w[maven nuget].include?(scheme) ? scheme : nil
@@ -199,7 +228,10 @@ module Vers
       
       # Handle || (OR) operator
       if range_string.include?('||')
-        or_parts = range_string.split('||').map(&:strip)
+        or_parts = range_string.split('||', MAX_CONSTRAINTS + 1).map(&:strip)
+        if or_parts.length > MAX_CONSTRAINTS
+          raise ArgumentError, "Too many || clauses (> #{MAX_CONSTRAINTS})"
+        end
         ranges = or_parts.map { |part| parse_npm_range(part) }
         return ranges.reduce { |acc, range| acc.union(range) }
       end
@@ -231,15 +263,12 @@ module Vers
     end
 
     def parse_npm_single_range(range_string)
-      # Check cache first
       cache_key = "npm:#{range_string}"
-      if @@parser_cache.key?(cache_key)
-        return @@parser_cache[cache_key]
-      end
-      
-      # Limit cache size
+      return @@parser_cache[cache_key] if @@parser_cache.key?(cache_key)
+
       if @@parser_cache.size >= @@cache_size_limit
-        @@parser_cache.clear
+        keys = @@parser_cache.keys
+        keys.first(keys.size / 2).each { |k| @@parser_cache.delete(k) }
       end
       
       result = case range_string
@@ -500,7 +529,7 @@ module Vers
               begin
                 parsed_range = parse_maven_range(range_part)
                 ranges << parsed_range
-              rescue
+              rescue ArgumentError
                 # If parsing fails, skip this part
               end
             end

data/lib/vers/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Vers
-  VERSION = "1.2.1"
+  VERSION = "1.3.1"
 
   ##
   # Handles version comparison and normalization across different package ecosystems.
@@ -18,19 +18,28 @@ module Vers
   class Version
     # Cache for parsed versions to avoid repeated parsing
     @@version_cache = {}
-    @@cache_size_limit = 1000
+    @@cache_size_limit = 2000
     # Regex for parsing semantic version components including build metadata
     SEMANTIC_VERSION_REGEX = /\A(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-([^+]+))?(?:\+(.+))?\z/
 
+    # Maximum accepted length for a version string. Real-world version
+    # strings rarely exceed 100 characters; 256 leaves headroom for unusual
+    # prerelease tags while bounding regex/split work and cache key size.
+    MAX_LENGTH = 256
+
     attr_reader :major, :minor, :patch, :prerelease, :build
 
     ##
     # Creates a new Version object
     #
     # @param version_string [String] The version string to parse
+    # @raise [ArgumentError] if the version string exceeds MAX_LENGTH
     #
     def initialize(version_string)
       @original = version_string.to_s
+      if @original.length > MAX_LENGTH
+        raise ArgumentError, "Version string too long (#{@original.length} > #{MAX_LENGTH})"
+      end
       parse_version
     end
 
@@ -41,11 +50,16 @@ module Vers
     # @return [Version] Cached or new Version object
     #
     def self.cached_new(version_string)
-      # Limit cache size to prevent memory bloat
+      # Skip caching for oversized keys to bound cache memory by entry
+      # count, not by attacker-controlled key length.
+      return new(version_string) if version_string.to_s.length > MAX_LENGTH
+
       if @@version_cache.size >= @@cache_size_limit
-        @@version_cache.clear
+        # Keep the most recent half instead of clearing everything
+        keys = @@version_cache.keys
+        keys.first(keys.size / 2).each { |k| @@version_cache.delete(k) }
       end
-      
+
       @@version_cache[version_string] ||= new(version_string)
     end
 
@@ -145,15 +159,17 @@ module Vers
     # @return [String] The normalized version string
     #
     def to_s
-      version = "#{major || 0}"
-      version += ".#{minor || 0}"
-      version += ".#{patch || 0}"
-      version += "-#{prerelease}" if prerelease
-      version
+      @to_s ||= begin
+        version = "#{major || 0}"
+        version += ".#{minor || 0}"
+        version += ".#{patch || 0}"
+        version += "-#{prerelease}" if prerelease
+        version.freeze
+      end
     end
 
     def ==(other)
-      other.is_a?(Version) && self <=> other == 0
+      other.is_a?(Version) && (self <=> other) == 0
     end
 
     def <(other)
@@ -320,7 +336,7 @@ module Vers
       @original = @original.sub(/\Av/i, '')
 
       # Handle simple numeric versions (optimized case)
-      if @original.match(/^\d+$/)
+      if @original.match?(/^\d+$/)
         @major = @original.to_i
         return
       end
@@ -382,7 +398,7 @@ module Vers
         return 1 if part_b.nil?
         
         # Try numeric comparison first
-        if part_a.match(/^\d+$/) && part_b.match(/^\d+$/)
+        if part_a.match?(/^\d+$/) && part_b.match?(/^\d+$/)
           numeric_cmp = part_a.to_i <=> part_b.to_i
           return numeric_cmp unless numeric_cmp == 0
         else

data/lib/vers/version_range.rb

@@ -9,7 +9,7 @@ module Vers
 
     def initialize(intervals = [], raw_constraints: nil, scheme: nil)
       @scheme = scheme
-      @intervals = intervals.compact.reject(&:empty?)
+      @intervals = intervals.select { |i| i && !i.empty? }
       if @scheme
         @intervals.sort! { |a, b| compare_interval_bounds(a, b) }
       else

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vers
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.3.1
 platform: ruby
 authors:
 - Andrew Nesbitt