{"record":{"id":"4349575fb4206bc6","repo":"spring-projects/spring-security","slug":"invalid-item","errorCode":null,"errorMessage":"invalid item: ","messagePattern":"invalid item: ","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/core/ComparableVersion.java","lineNumber":141,"sourceCode":"\t\t}\n\n\t\t@Override\n\t\tpublic boolean isNull() {\n\t\t\treturn value == 0;\n\t\t}\n\n\t\t@Override\n\t\tpublic int compareTo(@Nullable Item item) {\n\t\t\tif (item == null) {\n\t\t\t\treturn (value == 0) ? 0 : 1; // 1.0 == 1, 1.1 > 1\n\t\t\t}\n\n\t\t\treturn switch (item.getType()) {\n\t\t\t\tcase INT_ITEM -> Integer.compare(value, ((IntItem) item).value);\n\t\t\t\tcase LONG_ITEM, BIGINTEGER_ITEM -> -1;\n\t\t\t\tcase STRING_ITEM -> 1; // 1.1 > 1-sp\n\t\t\t\tcase LIST_ITEM -> 1; // 1.1 > 1-1\n\t\t\t\tdefault -> throw new IllegalStateException(\"invalid item: \" + item.getClass());\n\t\t\t};\n\t\t}\n\n\t\t@Override\n\t\tpublic boolean equals(@Nullable Object o) {\n\t\t\tif (this == o) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tif (o == null || getClass() != o.getClass()) {\n\t\t\t\treturn false;\n\t\t\t}\n\n\t\t\tIntItem intItem = (IntItem) o;\n\n\t\t\treturn value == intItem.value;\n\n\t\t}\n","sourceCodeStart":123,"sourceCodeEnd":159,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/core/ComparableVersion.java#L123-L159","documentation":"ComparableVersion's IntItem.compareTo throws IllegalStateException('invalid item: ' + item.getClass()) when an integer version item is compared against an item type it cannot handle (LONG_ITEM or BIGINTEGER_ITEM per this branch). ComparableVersion parses version strings into typed items; the switch must cover every item type, and this default arm signals a comparator/parsing invariant break. In practice it means version items of mixed types reached a comparison path that was not designed for them.","triggerScenarios":"Comparing two version strings whose parsed item types disagree in a way this branch does not handle (e.g. '1' vs '9007199254740993' where the second parses as a long/bigint item); passing a hand-built or foreign ComparableVersion item into the comparison; a modified/patched ComparableVersion with an incomplete switch.","commonSituations":"Dependency-management code (this class originates from Maven) comparing unusual version strings with extremely large numeric segments; frameworks embedding ComparableVersion for feature/version gating receiving unexpected formats.","solutions":["Normalize version strings before comparison so numeric items stay in the same type class (e.g. compare '1' and '1.0' consistently, avoid gigantic numeric segments)","Upgrade to a Spring Security version with the fixed/complete ComparableVersion switch handling mixed INT/LONG/BIGINTEGER comparisons","Catch IllegalStateException around version comparison and fall back to string comparison for exotic inputs","If you feed ComparableVersion programmatically, only construct it from well-formed version strings (digits, dots, hyphenated qualifiers)"],"exampleFix":"// before\nboolean ok = new ComparableVersion(\"1\").compareTo(new ComparableVersion(\"9999999999999999999999\")) < 0; // IntItem vs BigIntegerItem\n// after\nboolean ok = new ComparableVersion(\"1.0.0\").compareTo(new ComparableVersion(\"2147483648.0.0\")) < 0; // keep segments within int range","handlingStrategy":"fallback","validationCode":"if (!version.matches(\"^[0-9A-Za-z][0-9A-Za-z.\\-]*$\") || version.matches(\".*\\\\d{15,}.*\")) { throw new IllegalArgumentException(\"unsupported version format: \" + version); }","typeGuard":null,"tryCatchPattern":"int cmp; try { cmp = new ComparableVersion(a).compareTo(new ComparableVersion(b)); } catch (IllegalStateException e) { cmp = a.compareTo(b); }","preventionTips":["Keep version numeric segments within 32-bit range so all items parse as IntItem","Only build ComparableVersion from well-formed version strings","Prefer parsing versions with a single consistent library version on the classpath"],"tags":["versioning","comparable-version","illegal-state"],"backgroundTag":"internal-invariant-violation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}