Skip to content

Add Masterminds/semver — semantic version parsing library (Go, zero deps)#15643

Closed
canolgun wants to merge 2 commits into
google:masterfrom
canolgun:semver-fuzz-integration
Closed

Add Masterminds/semver — semantic version parsing library (Go, zero deps)#15643
canolgun wants to merge 2 commits into
google:masterfrom
canolgun:semver-fuzz-integration

Conversation

@canolgun

@canolgun canolgun commented Jun 8, 2026

Copy link
Copy Markdown

Masterminds/semver is a widely-used Go library for semantic version parsing,
constraint matching, and version comparison. It has zero external dependencies
and 3K+ GitHub stars, making it an ideal OSS-Fuzz candidate.

Fuzz targets (4 new)

Target Coverage
FuzzVersionCompare Comparison invariants, antisymmetry, LessThan/GreaterThan/Equal consistency, nil safety
FuzzVersionRoundTrip Parse → String → Parse → Equal cycle
FuzzIncOverflow MaxUint64 overflow on IncPatch/IncMinor/IncMajor, panic recovery, increment invariants
FuzzConstraintVersionCheck Constraint × Version integration, nil Check/Validate on invalid input

Upstream fuzz targets (3 existing, enriched)

The upstream repo already has 3 fuzz targets (FuzzNewVersion, FuzzStrictNewVersion, FuzzNewConstraint). This integration adds 4 additional targets focusing on invariants, overflow safety, and nil-pointer resilience.

Sanitizers

  • address
  • memory

Fuzzing engine

  • libfuzzer (Go native fuzz)

@google-cla

google-cla Bot commented Jun 8, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@github-actions

github-actions Bot commented Jun 8, 2026

Copy link
Copy Markdown

canolgun-commits is integrating a new project:
- Main repo: https://github.com/dgraph-io/badger
- Criticality score: 0.52286
canolgun-commits is integrating a new project:
- Main repo: https://github.com/dgraph-io/badger
- Criticality score: 0.52286
canolgun-commits is integrating a new project:
- Main repo: https://github.com/dgraph-io/badger
- Criticality score: 0.52286
canolgun-commits is integrating a new project:
- Main repo: https://github.com/dgraph-io/badger
- Criticality score: 0.52286
canolgun-commits is integrating a new project:
- Main repo: https://github.com/dgraph-io/badger
- Criticality score: 0.52286
canolgun-commits is integrating a new project:
- Main repo: https://github.com/dgraph-io/badger
- Criticality score: 0.52286
canolgun-commits is integrating a new project:
- Main repo: https://github.com/dgraph-io/badger
- Criticality score: 0.52286
canolgun-commits is integrating a new project:
- Main repo: https://github.com/dgraph-io/badger
- Criticality score: 0.52286

@canolgun

Copy link
Copy Markdown
Author

@googlebot I signed it!

@canolgun

Copy link
Copy Markdown
Author

I have signed the Google CLA (canolgun@gmail.com). The CLA check at https://cla.developers.google.com/ shows signed. Please re-trigger the check.

@canolgun

Copy link
Copy Markdown
Author

CLA should now be linked to GitHub username canolgun-commits. @googlebot please recheck.

@canolgun canolgun closed this Jun 11, 2026
@canolgun canolgun reopened this Jun 11, 2026
@canolgun canolgun closed this Jun 11, 2026
@canolgun canolgun reopened this Jun 11, 2026
semantic version parsing library (Go, zero deps).
4 fuzz targets: VersionCompare, VersionRoundTrip, IncOverflow,
ConstraintVersionCheck.

Sanitizers: address, memory
Engine: libfuzzer (Go native fuzz)
@canolgun
canolgun force-pushed the semver-fuzz-integration branch from 7942c87 to e3efd05 Compare June 11, 2026 00:26
@canolgun canolgun closed this Jun 11, 2026
@canolgun canolgun reopened this Jun 11, 2026
@canolgun

Copy link
Copy Markdown
Author

Merged into #15627 — all 10 integrations now in one PR.

@canolgun canolgun closed this Jun 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant