Package version is not valid semver: ${baseVersion}

Error message

Package version is not valid semver: ${baseVersion}

What it means

Thrown by createAdhocBuildVersion when baseVersion does not match ^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?$. The adhoc version builder strips any prerelease tail and re-stamps the base with -adhoc.<UTC-to-the-second>, so it requires a valid semver core (major.minor.patch) plus an optional prerelease it can safely discard.

Source

Thrown at config/scripts/adhoc-build-version.mjs:26

} from './dev-channel-base-version.mjs'

/** Long enough to name a feature, short enough that a picker row stays readable. */
export const ADHOC_LABEL_MAX_LENGTH = 32

/**
 * `1.4.160-adhoc.20260728140533` — UTC to the second, so tags sort
 * chronologically by semver and every build is uniquely versioned.
 *
 * Why seconds when hourly uses minutes: hourly runs under a concurrency group and
 * cannot overlap itself. Adhoc builds are dispatched on demand, so two people
 * cutting from different branches in the same minute is ordinary — and a
 * minute-resolution tag would collide and fail the second build after its whole
 * pack-and-notarize run.
 */
export function createAdhocBuildVersion(baseVersion, date) {
  const match = /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?$/.exec(baseVersion)
  if (!match) {
    throw new Error(`Package version is not valid semver: ${baseVersion}`)
  }
  if (!(date instanceof Date) || Number.isNaN(date.getTime())) {
    throw new Error('Adhoc build timestamp is invalid.')
  }
  const pad = (value, width = 2) => String(value).padStart(width, '0')
  const stamp = [
    pad(date.getUTCFullYear(), 4),
    pad(date.getUTCMonth() + 1),
    pad(date.getUTCDate()),
    pad(date.getUTCHours()),
    pad(date.getUTCMinutes()),
    pad(date.getUTCSeconds())
  ].join('')
  // Why: drop any -rc.N tail, same as hourly. Keeping it would make every adhoc
  // build semver-NEWER than the RC it was cut from, letting an ordinary
  // RC-channel check offer an unreviewed branch build to RC users. Stripping to
  // the base parks adhoc below rc.N, hourly, and stable ('adhoc' sorts first
  // alphabetically), reachable only by an explicit pinned jump.

View on GitHub (pinned to 1136503c6a)

Solutions

Check package.json version and set it to a valid MAJOR.MINOR.PATCH (optionally with a prerelease).
If the bad value came from resolveDevChannelBaseVersion, inspect the ORCA_PUBLISHED_VERSIONS env / workflow output it reads from and ensure at least one valid RC version is present.
Add a unit test asserting createAdhocBuildVersion only ever receives output of resolveDevChannelBaseVersion validated by the same regex.
Surface a clearer error in resolveDevChannelBaseVersion so the failure points at the upstream source rather than the regex here.

Example fix

// before
// package.json: "version": "dev"
// node config/scripts/adhoc-build-version.mjs
// -> 'Package version is not valid semver: dev'

// after
// package.json: "version": "1.4.160-rc.1"
// node config/scripts/adhoc-build-version.mjs
// -> version=1.4.160-adhoc.20260728140533

Defensive patterns

Strategy: validation

Validate before calling

const SEMVER_RE = /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?$/

function assertValidBaseVersion(baseVersion) {
  if (!SEMVER_RE.test(baseVersion)) {
    throw new Error(`Refusing to build adhoc version: '${baseVersion}' is not semver. Check package.json version.`)
  }
}
// assertValidBaseVersion(baseVersion) before createAdhocBuildVersion

Type guard

function isValidBaseVersion(value) {
  return typeof value === 'string' && /^(\d+\.\d+\.\d+)(?:-[0-9A-Za-z.-]+)?$/.test(value)
}

Prevention

Keep package.json version always valid semver, even on feature branches (no 'dev' / '0.0.0' placeholders).
Add a CI lint that asserts package.json.version matches the semver regex before any release workflow can run.
Validate resolveDevChannelBaseVersion's output with the same regex at its boundary, so the failure surfaces at the real source.

When it happens

Trigger: package.json version is empty, a non-semver string like 'dev', or a VCS-resolved version; resolveDevChannelBaseVersion returned a malformed value because no published RC version was found and the fallback path produced garbage.

Common situations: Branch where package.json was temporarily set to a placeholder version; an env-driven version stamp produced something like '0.0.0-custom+sha'; the workflow's published-versions env input was empty and resolveDevChannelBaseVersion fell back to an unparseable string.

Related errors

AI-assisted analysis of stablyai/orca@1136503c6a (2026-08-12). Data as JSON: /api/errors/fdce4f3ff8f0e111. Report an issue: GitHub.