[AssetMapper] Warning thrown when dependency version is within valid range

[tacman]

Symfony version(s) affected

6.4

Description

when installing a package, I'm getting

 [warning] datatables.net-scroller-bs5 requires datatables.net-bs5@1.11 - 2 but version 2.0.3 is installed.

but 1.11 - 2 includes 2.0.3

Checking with the npm SemVer Calculator appears to confirm this:

How to reproduce

bin/console importmap:require datatables.net-scroller-bs5
bin/console importmap:update

[warning] datatables.net-scroller-bs5 requires datatables.net-bs5@1.11 - 2 but version 2.0.3 is installed.
[warning] datatables.net-scroller-bs5 requires datatables.net-bs5@1.11 - 2 but version 2.0.3 is installed.

 [OK] Updated all packages in importmap.php.                                                                            

Possible Solution

Perhaps the way the semver string is being parsed isn't including the minor / patch releases. I had a different but similar issue with phar-io/version

phar-io/version#34

Additional Context

No response

[Jean-Beru]

The AssetMapper version checker converts 1.11 - 2 to >=1.11 <=2 which is still valid.

But Semver::statisfies from https://github.com/composer/semver returns false when comparing this range to 2.3.0.

IMO, we can open an issue in this repository.

[tacman]

It looks like the tests don't cover a version range without a minor version.

https://github.com/symfony/symfony/blob/6.4/src/Symfony/Component/AssetMapper/Tests/ImportMap/ImportMapVersionCheckerTest.php#L308-L311

// Hyphen Ranges
        yield 'hyphen range simple' => [
            '1.0.0 - 2.0.0',
            '>=1.0.0 <=2.0.0',
        ];

        yield 'hyphen range with v prefix' => [
            'v1.0.0 - 2.0.0',
            '>=1.0.0 <=2.0.0',
        ];

        yield 'hyphen range without patch' => [
            '1.0 - 2.0',
            '>=1.0 <=2.0',
        ];

        yield 'hyphen range with no spaces' => [
            '1.0-v2.0',
            '>=1.0 <=2.0',
        ];

[stof]

<=2 does not have the same meaning in Composer and in npm. In Composer, 2, 2.0 and 2.0.0 are the same version, even when using in constraint bounds.

[Jean-Beru]

An other solution may be to keep the 1.11 - 2 syntax, instead of converting it, since Composer supports it.