Semver Range Tester

The two rules people get wrong

A caret allows changes that do not modify the leftmost non-zero part of the version. On a released package that means the major is pinned, which everybody knows. On a zero-major package it means the minor is pinned - so a caret on a zero-point-two release behaves exactly like a tilde, and will not accept the next minor.

That is not a footnote. Every pre-1.0 dependency in a lockfile is governed by it, and it is the single most surprising behaviour in the system. A caret on a zero-zero-x version is narrower still: it accepts nothing but that exact version.

The second rule is prereleases. A release candidate does not satisfy an ordinary range even when it falls inside the numeric window, because a prerelease only qualifies if the range itself names a prerelease at the same major, minor and patch. That is why an install can refuse a version that looks obviously in range, and the tool says so explicitly rather than returning a bare no.

What it accepts

The range grammar npm evaluates a manifest against, which is the one most people mean when they say semver range.

• Caret and tilde, including the two-part and one-part spellings
• Comparators - greater than, less than, and their inclusive forms
• x-ranges and the bare asterisk
• Hyphen ranges, inclusive at both ends, with an open upper bound
• Alternatives joined by a double pipe, evaluated as a union

Why the answer comes with a reason

A boolean answers the literal question and leaves you no better informed the next time. Every verdict here carries the expansion of the range into comparators and a sentence explaining the outcome, so the rule is learnable rather than merely applied.

Below the verdict is a table of the comparisons that catch people out, each row a real behaviour rather than a simplification.

What it will not do

This is npm’s interpretation, which is what a package manifest is evaluated against. Other ecosystems differ in places that matter - most notably Cargo, where a bare version is treated as a caret range by default, and Go modules, which use minimal version selection rather than range resolution at all.

It also does not resolve a dependency tree. Whether an upgrade is safe depends on transitive constraints, peer dependencies and what your lockfile already pins, none of which a single version and a single range can express.