fix(diff): flag 0.x minor bumps as breaking (semver initial-development rule)

[dmchaledev]

Summary

isMajorVersionBump() in src/diff.ts classified a bump as breaking only when the numeric major component increased. That misses semver's initial-development rule for the pre-1.0 (0.x) range, which is honoured in practice by npm's caret ranges (^0.2.0 allows 0.2.x but not 0.3.0), Cargo, and Composer: while the major is 0, a minor bump is a breaking change.

As a result, a very common class of upgrade was silently reported as safe:

// current main
isMajorVersionBump('0.1.0', '0.2.0') // => false  ❌ (this is breaking)

For a supply-chain risk tool, under-reporting breaking upgrades of the many 0.x packages in a typical dependency tree undersells the headline [MAJOR] / "Major? Yes" signal in every output format.

Change

isMajorVersionBump() now also flags a 0.x upgrade as breaking when the minor component increases while the major stays 0:

From	To	Before	After
0.1.0	0.2.0	false	true
0.2.0	0.2.1	false	false (patch, unchanged)
0.9.0	1.0.0	true	true (unchanged)
17.0.2	18.2.0	true	true (unchanged)
4.17.20	4.17.21	false	false (unchanged)

Version parsing is factored into a small parseVersion() helper that tolerates a leading v and pre-release/build suffixes (e.g. 2.0.0-beta). Downgrades are not treated as bumps. Behaviour for >= 1.0 versions is unchanged, so this is backward compatible for all post-1.0 dependencies.

Scope

• Touches only the isMajorVersionBump internals in src/diff.ts and adds tests. The public VersionChange.isMajorBump field, the reporter, and the CLI are unchanged.
• Orthogonal to the open PRs: the purl-key upgrade-detection cluster (fix: correct upgrade detection and CLI default format #8/fix: detect version upgrades by purl and repair default CLI invocation #10/fix(diff): detect upgrades for version-qualified purls #20/fix(diff): detect version upgrades for version-qualified purls #31/fix(diff): detect upgrades when the purl carries the version #37/fix(diff): detect upgrades when purls embed the version #42/fix(diff): detect version upgrades when purls include the version #44/fix(diff): detect upgrades by stripping version from purl key #47) changes how components are matched; the downgrade PR (feat(diff): detect version downgrades instead of mislabeling them as upgrades #24) adds a separate category. None of them change how a matched upgrade is classified as breaking, so this composes cleanly with whichever of those lands.

Tests

npm test — 32 passing (added: 0.x minor bump ⇒ breaking, 0.x patch bump ⇒ not breaking, 0.x → 1.x graduation ⇒ breaking). Typecheck and lint clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QtAD7yBCFLNhvjcrWBtCQ4

---

Generated by Claude Code