From d4c005f3a5a1fda35ceda27e121803e138cfb9f0 Mon Sep 17 00:00:00 2001
From: Julian Gruber <julian@juliangruber.com>
Date: Thu, 21 Jun 2018 18:15:25 +0200
Subject: [PATCH] fix invalid semver in release. closes #61

---
 index.js      |  8 +++++++-
 test/index.js | 27 ++++++++++++++++++++++++++-
 2 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/index.js b/index.js
index 1101063a..9fb2f754 100644
--- a/index.js
+++ b/index.js
@@ -162,7 +162,13 @@ class Updates {
 
     const releases = await res.json()
     for (const release of releases) {
-      if (release.draft || release.prerelease) continue
+      if (
+        !semver.valid(release.tag_name) ||
+        release.draft ||
+        release.prerelease
+      ) {
+        continue
+      }
       for (const asset of release.assets) {
         const platform = assetPlatform(asset.name)
         if (platform && !latest[platform]) {
diff --git a/test/index.js b/test/index.js
index 7f34635e..11e42983 100644
--- a/test/index.js
+++ b/test/index.js
@@ -121,6 +121,24 @@ nock('https://api.github.com')
       ]
     }
   ])
+  .get('/repos/owner/repo-invalid-semver/releases?per_page=100')
+  .reply(200, [
+    {
+      name: 'name',
+      tag_name: 'invalid-semver',
+      body: 'notes',
+      assets: [
+        {
+          name: 'win32-ia32.zip',
+          browser_download_url: 'win32-ia32.zip'
+        },
+        {
+          name: 'win32-x64.zip',
+          browser_download_url: 'win32-x64.zip'
+        }
+      ]
+    }
+  ])
 nock('https://github.com')
   .get('/owner/repo/releases/download/1.0.0/RELEASES')
   .reply(200, 'HASH name.nupkg NUMBER')
@@ -175,13 +193,20 @@ test('Updates', async t => {
       }
     })
 
-    await t.test('invalid semver', async t => {
+    await t.test('invalid semver in request', async t => {
       const res = await fetch(`${address}/owner/repo/darwin/latest`)
       t.equal(res.status, 400)
       const body = await res.text()
       t.equal(body, 'Invalid SemVer: "latest"')
     })
 
+    await t.test('invalid semver in release', async t => {
+      const res = await fetch(
+        `${address}/owner/repo-invalid-semver/darwin/0.0.0`
+      )
+      t.equal(res.status, 404)
+    })
+
     await t.test('exists but has no releases', async t => {
       for (let i = 0; i < 2; i++) {
         const res = await fetch(