SemVer regex used to parse SemVer strings is broken.

In semver_parse.cmake, you have:

 set(semver_identifier_regex "[0-9A-Za-z-]+")
 set(semver_major_regex "[0-9]+")
 set(semver_minor_regex "[0-9]+")
 set(semver_patch_regex "[0-9]+")
 set(semver_identifiers_regex "${semver_identifier_regex}(\\.${semver_identifier_regex})*") 
 set(semver_prerelease_regex "${semver_identifiers_regex}")
 set(semver_metadata_regex "${semver_identifiers_regex}")
 set(semver_version_regex "(${semver_major_regex})\\.(${semver_minor_regex})\\.(${semver_patch_regex})")
 set(semver_regex "(${semver_version_regex})(-${semver_prerelease_regex})?(\\+${semver_metadata_regex})?")

I am not familiar with the cmake language, but I don't see where any of this excludes leading zeroes in numeric fields. As per the SemVer 2.0 spec, numeric fields may appear in the version triple (either major, minor or patch) and in prerelease fields (fields are dot delimited), and they may not have leading zeros. The following version strings are not SemVer compliant:

01.0.0 // Leading zero in major field.
1.01.0 // Leading zero in minor field.
1.0.01 // Leading zero in patch filed.
1.0.0-01 // Leading zero in prerelease field.
1.0.0-1.01 // Leading zero in prerelease field.

Please see the suggested regex's provided near the end of the FAQ and the discussion threads that eventually lead to their adoption, particularly the minimal set of oracles used to test them.

For major, minor and patch, you should have (0|[1-9]\d*), and prerelease is something like (?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*. The reason for the more complex prerelease part is due to the fact that a prerelease tag consists of either numeric or alphanumeric fields, delimited by periods.

Based on what you have in that file, I think you would also reject a valid SemVer strings of the form 1.0.0+meta and 1.0.0-prr+meta.1.

toeb / cmakepp

SemVer regex used to parse SemVer strings is broken. #133