Shopify · amcaplan · Jun 5, 2026
@@ -0,0 +1,5 @@
+---
+'@shopify/cli-kit': patch
+---
+
+Replace direct semver usage with compare-versions.
@@ -121,6 +121,7 @@
     "chalk": "5.4.1",
     "change-case": "4.1.2",
     "color-json": "3.0.5",
+    "compare-versions": "6.1.1",
     "conf": "11.0.2",
     "deepmerge": "4.3.1",
     "dotenv": "16.4.7",
@@ -151,7 +152,6 @@
     "open": "8.4.2",
     "pathe": "1.1.2",
     "react": "19.2.4",
-    "semver": "7.6.3",
     "stacktracey": "2.1.8",
     "strip-ansi": "7.1.0",
     "supports-hyperlinks": "3.1.0",
@@ -165,7 +165,6 @@
     "@types/gradient-string": "^1.1.2",
     "@types/lodash": "4.17.19",
     "@types/react": "^19.0.0",
-    "@types/semver": "^7.5.2",
     "@types/which": "3.0.4",
     "@vitest/coverage-istanbul": "^3.1.4",
     "msw": "^2.7.1",

@@ -23,6 +23,7 @@ import {
   PackageManager,
   npmLockfile,
   lockfilesByManager,
+  versionSatisfies,
 } from './node-package-manager.js'
 import {captureOutput, exec} from './system.js'
 import {inTemporaryDirectory, mkdir, touchFile, writeFile} from './fs.js'
@@ -584,6 +585,26 @@ describe('checkForCachedNewVersion', () => {
   })
 })
 
+describe('versionSatisfies', () => {
+  test.each<[boolean, string, string]>([
+    [true, '1.2.3', '>=1.0.0'],
+    [true, '1.2.3', '<=1.2.3'],
+    [false, '1.2.3', '<1.2.3'],
+    [false, '1.2', '>=1.2.0'],
+    [true, '2.0.0', '<=2.0'],
+    [true, '2.0.1', '<=2.0'],
+    [false, '2.1.0', '<=2.0'],
+    [false, '0.0.0-snapshot', '<1.0.0'],
+    [false, '1.2.3-alpha.1', '<1.2.3'],
+    [true, '1.2.3-alpha.1', '>=1.2.3-alpha.0'],
+    [true, '1.2.3-alpha.1', '<=1.2.3-alpha.1'],
+    [true, '1.2.3-alpha.1', '<1.2.3-alpha.2'],
+    [false, '1.2.4-alpha.1', '>1.2.3-alpha.1'],
+  ])('returns %s for version %s and requirements %s', (expected, version, requirements) => {
+    expect(versionSatisfies(version, requirements)).toBe(expected)
+  })
+})
+
 describe('checkForNewVersion', () => {
   beforeEach(() => cacheClear())
   afterEach(() => {

@@ -8,7 +8,7 @@ import {inferPackageManagerForGlobalCLI} from './is-global.js'
 import {outputToken, outputContent, outputDebug} from './output.js'
 import {PackageVersionKey, cacheRetrieve, cacheRetrieveOrRepopulate} from '../../private/node/conf-store.js'
 import {parseJSON} from '../common/json.js'
-import {SemVer, satisfies as semverSatisfies} from 'semver'
+import {compareVersions, satisfies as versionSatisfiesRequirement} from 'compare-versions'
 import type {Writable} from 'stream'
 import type {ExecOptions} from './system.js'
 
@@ -334,7 +334,7 @@ export async function checkForNewVersion(
     return undefined
   }
 
-  if (lastVersion && new SemVer(currentVersion).compare(lastVersion) < 0) {
+  if (lastVersion && compareVersions(currentVersion, lastVersion) < 0) {
     return lastVersion
   } else {
     return undefined
@@ -351,7 +351,7 @@ export function checkForCachedNewVersion(dependency: string, currentVersion: str
   const cacheKey: PackageVersionKey = `npm-package-${dependency}`
   const lastVersion = cacheRetrieve(cacheKey)?.value
 
-  if (lastVersion && new SemVer(currentVersion).compare(lastVersion) < 0) {
+  if (lastVersion && compareVersions(currentVersion, lastVersion) < 0) {
     return lastVersion
   } else {
     return undefined
@@ -365,7 +365,39 @@ export function checkForCachedNewVersion(dependency: string, currentVersion: str
  * @returns A boolean indicating whether the version satisfies the requirements
  */
 export function versionSatisfies(version: string, requirements: string): boolean {
-  return semverSatisfies(version, requirements)
+  if (!semverVersionRegex.test(version)) return false
+
+  const prereleaseBaseVersion = baseVersionForPrerelease(version)
+  // semver excludes prerelease candidates from normal ranges unless the range opts into that prerelease tuple.
+  if (prereleaseBaseVersion && !requirementsTargetPrereleaseBaseVersion(requirements, prereleaseBaseVersion)) {
+    return false
+  }
+
+  return versionSatisfiesRequirement(version, normalizeSemverPartialRequirements(requirements))
+}
+
+const semverVersionRegex = /^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/
+const prereleaseVersionRegex = /^v?(\d+)\.(\d+)\.(\d+)-[^+]+(?:\+.*)?$/
+const prereleaseRequirementRegex = /v?(\d+)\.(\d+)\.(\d+)-[0-9A-Za-z.-]+(?:\+[0-9A-Za-z.-]+)?/g
+const partialMinorUpperBoundRegex = /(^|\s)<=\s*v?(\d+)\.(\d+)(?=$|\s)/g
+
+function baseVersionForPrerelease(version: string): string | undefined {
+  const prereleaseMatch = version.match(prereleaseVersionRegex)
+  if (!prereleaseMatch) return undefined
+
+  return `${prereleaseMatch[1]}.${prereleaseMatch[2]}.${prereleaseMatch[3]}`
+}
+
+function requirementsTargetPrereleaseBaseVersion(requirements: string, baseVersion: string): boolean {
+  return Array.from(requirements.matchAll(prereleaseRequirementRegex)).some((requirementMatch) => {
+    return `${requirementMatch[1]}.${requirementMatch[2]}.${requirementMatch[3]}` === baseVersion
+  })
+}
+
+function normalizeSemverPartialRequirements(requirements: string): string {
+  return requirements.replace(partialMinorUpperBoundRegex, (_match, prefix: string, major: string, minor: string) => {
+    return `${prefix}<${major}.${Number(minor) + 1}.0`
+  })
 }
 
 /**

@@ -1,5 +1,5 @@
 import {captureOutput} from './system.js'
-import {localCLIVersion, globalCLIVersion, isPreReleaseVersion} from './version.js'
+import {localCLIVersion, globalCLIVersion, isPreReleaseVersion, isMajorVersionChange} from './version.js'
 import {inTemporaryDirectory} from './fs.js'
 import {describe, expect, test, vi} from 'vitest'
 
@@ -89,3 +89,26 @@ describe('isPreReleaseVersion', () => {
     expect(isPreReleaseVersion('3.68.0')).toBe(false)
   })
 })
+
+describe('isMajorVersionChange', () => {
+  test('returns true when the major version changes', () => {
+    expect(isMajorVersionChange('3.68.0', '4.0.0')).toBe(true)
+  })
+
+  test('returns false when the major version stays the same', () => {
+    expect(isMajorVersionChange('3.68.0', '3.69.0')).toBe(false)
+  })
+
+  test('handles a leading v and prerelease suffix', () => {
+    expect(isMajorVersionChange('v3.68.0-alpha.1', '3.69.0')).toBe(false)
+  })
+
+  test('throws for partial versions', () => {
+    expect(() => isMajorVersionChange('3.68', '4.0.0')).toThrow('Invalid version: 3.68')
+  })
+
+  test('returns false for prerelease CLI versions', () => {
+    expect(isMajorVersionChange('0.0.0-snapshot', '4.0.0')).toBe(false)
+    expect(isMajorVersionChange('3.68.0', '0.0.0-snapshot')).toBe(false)
+  })
+})
@@ -1,6 +1,6 @@
 import {captureOutput} from './system.js'
 import which from 'which'
-import {satisfies, SemVer} from 'semver'
+import {satisfies, validateStrict} from 'compare-versions'
 /**
  * Returns the version of the local dependency of the CLI if it's installed in the provided directory.
  *
@@ -54,6 +54,12 @@ export function isPreReleaseVersion(version: string): boolean {
   return version.startsWith('0.0.0')
 }
 
+function majorVersion(version: string): number {
+  const normalizedVersion = version.replace(/^v/, '')
+  if (!validateStrict(normalizedVersion)) throw new Error(`Invalid version: ${version}`)
+  return Number(normalizedVersion.split('.')[0])
+}
+
 /**
  * Checks if there is a major version change between two versions.
  * Pre-release versions (0.0.0-*) are treated as not having a major version change.
@@ -64,7 +70,5 @@ export function isPreReleaseVersion(version: string): boolean {
  */
 export function isMajorVersionChange(currentVersion: string, newerVersion: string): boolean {
   if (isPreReleaseVersion(currentVersion) || isPreReleaseVersion(newerVersion)) return false
-  const currentSemVer = new SemVer(currentVersion)
-  const newerSemVer = new SemVer(newerVersion)
-  return currentSemVer.major !== newerSemVer.major
+  return majorVersion(currentVersion) !== majorVersion(newerVersion)
 }