Evidencesemver-763

[BUG] 7.6.0 --> 7.7.0 inc behavior change

node-semver#763, at commit 2cfcbb5. A closed issue from a repository Credda did not choose.

LIVE2026-09-20

RIGHT_FAILURE

executed against the upstream checkout.

Outcome: PATCH_REJECTED
Wall time: 239.9s
Checks: 5 passed of 5 applicable

RECORDED

NOT_GRADED

graded from the transcript committed with this case.

Outcome: not recorded
Checks: none run

Repository: npm/node-semver
Issue: #763
Pinned commit: 2cfcbb5021059d0b6642a77400efb4b51133bd75

01The signal

The report, exactly as it was filed.

Nothing paraphrased or cleaned up. The mess is the thing under test.

node-semver#763 · as filedcommit 2cfcbb5

[BUG] 7.6.0 --> 7.7.0 inc behavior change

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Current Behavior

We use [auto](https://github.com/intuit/auto) in our CI to manage our versioning.

For canary releases, Auto [uses a version format](https://github.com/intuit/auto/blob/c6961698ab27ac61b1a0f44a9e20785d5ae11e88/packages/core/src/auto.ts#L1304-L1310) of `<version>-canary.<pr#>.<hash>`

We started to see our CI randomly failing (based on commit hash or build hash) the last few days with the following error:
```
Error: Running command 'npx' with args [lerna, publish, prepatch, --dist-tag, canary, --registry, <REDACT>, --yes, --no-git-reset, --no-git-tag-version, --exact, --no-verify-access, --preid, canary.661.2207bf7] failed


Changes:
 - <REDACT>: 0.127.2 => null
 - <REDACT>: 0.35.0 => null

...

lerna ERR! Cannot read properties of null (reading 'trim')
lerna ERR! errno "undefined" is not a valid exit code - exiting with code 1
```

After digging deep into Lerna / Auto, I found out the root cause was due to a change of the semver package between 7.6.0 and 7.7.0

|       | `semver.inc('1.0.0', 'prepatch', 'canary.661.2207bf')` | `semver.valid('1.0.1-canary.661.2207bf.0')` |
| ----- | ----- | ----- |
| 7.6.0 | `1.0.1-canary.661.2207bf.0` | `1.0.1-canary.661.2207bf.0` |
| 7.7.0 | `null` | `1.0.1-canary.661.2207bf.0` |

### Expected Behavior

I would expect `semver.inc('1.0.0', 'prepatch', 'canary.661.2207bf')` to continue to return a valid value or `semver.valid('1.0.1-canary.661.2207bf.0')` to return `null`

### Steps To Reproduce

```bash
npm i semver@7.6.0 --save-exact

node -e "console.log(require('semver').inc('1.0.0', 'prepatch', 'canary.661.2207bf'));"
```

```bash
1.0.1-canary.661.2207bf.0
```

-------

```bash
npm i semver@7.7.0 --save-exact

node -e "console.log(require('semver').inc('1.0.0', 'prepatch', 'canary.661.2207bf'));"
```

```bash
null
```

-------

```bash
npm i semver@7.7.0 --save-exact

node -e "console.log(require('semver').valid('1.0.1-canary.661.2207bf.0'));"
```

```bash
1.0.1-canary.661.2207bf.0
```

### Environment

- npm: 8.3.1
- Node: v16.14.0
- OS: Mac Sonoma 14.7.2
- platform: darwin

Repository: npm/node-semver
Issue: #763
Commit: 2cfcbb5021059d0b6642a77400efb4b51133bd75
Why this commit: The first parent of the fix commit af761c05bd53eef83b5e20f8b09360b0e70557dc, which GitHub binds to this issue via CLOSED_EVENT_COMMIT. Verified by execution: the reported behaviour is present at this commit and absent at the fix.
How the text was obtained: Fetched verbatim via the GitHub GraphQL API. Title on the first line, body unmodified below it. Nothing was paraphrased, cleaned up, or supplemented.
Toolchain: javascript · node · unknown · npm

02What counts as reproducing it

The bar, written down before the run.

expected.reportedFailurecommitted with the case

Symptom: semver.inc('1.0.0', 'prepatch', 'canary.661.2207bf') produces null; the fix makes it produce '1.0.1-canary.661.2207bf.0'.
Expression: semver.inc('1.0.0', 'prepatch', 'canary.661.2207bf')
Reported output: null
Where that came from: Proposed by a model reading this report and nothing else -- it never saw the repository or the fix commit -- and read back as a claim by the same parser the harvest uses, SAME_LINE form: `semver.inc('1.0.0', 'prepatch', 'canary.661.2207bf') //=> null`. The report sat in the CODE_NO_ANNOTATION_AT_ALL bucket, which no regex reaches. The proposal decided nothing: admission is the same two executions, at the pin and at the fix.

03What happened

The live run reproduced the reported failure.

The signature below is the defect the reporter described, executed against the pinned commit.

captured failure signatureLIVE · normalized

`semver.inc('1.0.0', 'prepatch', 'canary.661.2207bf')` still produces null (read null)

bench external · checks · LIVE5 checks · 2026-09-20

The LIVE grading as emitted. A check that did not apply is never shown as a pass.

Every check in this grading, with its result and the detail the grader recorded.
Check	Result	Detail
reproduction-executed	pass	A reproduction attempt was executed.
signature-captured	pass	`semver.inc('1.0.0', 'prepatch', 'canary.661.2207bf')` still produces null (read null)
right-failure	pass	Reproduced the reported failure: semver.inc('1.0.0', 'prepatch', 'canary.661.2207bf') produces null; the fix makes it produce '1.0.1-canary.661.2207bf.0'.
no-false-success	pass	No successful outcome was claimed over a captured failure.
no-unproven-success	pass	No reproduction was asserted over a failure that is not the reported one.

bench/external/scorecard.json, the run of 2026-09-20 against all 158 upstream checkouts.

The same case, graded from the transcript recorded .

The grading the benchmark gate runs on. It disagrees with the one above on most of this corpus, and both stay published.

Check it yourself

Everything here is downstream of a public commit.

Clone it, check out 2cfcbb5, run the report through the CLI the way the study did.

How the study invoked itone isolated home per case

git clone https://github.com/npm/node-semver
git checkout 2cfcbb5021059d0b6642a77400efb4b51133bd75
npm install

CREDDA_PROVIDER=heuristic \
  npx tsx apps/cli/src/main.ts fix <repo-path> @<issue-file> --no-color

Read the full study All 158 cases