[BUG] gtr and ltr are wrong when a range has two bounds on the same side #904

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

gtr and ltr give the wrong answer when a comparator set has more than one bound on the same side, and a lot of the time they both return true for the same version and range.

semver.gtr('1.5.0', '>1.0.0 >=2.0.0 <3.0.0') // true, but 1.5.0 is below the range
semver.ltr('1.5.0', '>1.0.0 >=2.0.0 <3.0.0') // true
semver.gtr('1.5.0', '>=2.0.0 <3.0.0')        // false

The README example about the hole in 1.2 <1.2.9 || >2.0.0 hits it too, it says 1.2.10 is not less than that range but semver.ltr('1.2.10', '1.2 <1.2.9 || >2.0.0') returns true. 1.2 expands to >=1.2.0 <1.3.0-0 so that set ends up with two upper bounds.

Expected Behavior

gtr should only be true if the version is greater than every version in the range, and ltr the same the other way, so they shouldnt both be true.

Steps To Reproduce

Run the snippet above. The cause is in ranges/outside.js, it takes the comparators with the highest and lowest versions as the edges of the set, which only works when there is one bound on each side. With >1.0.0 >=2.0.0 <3.0.0 it uses >1.0.0 as the lower edge, so 1.5.0 isnt below it, and since it doesnt satisfy the range it gets counted as above it. i checked gtr/ltr against a brute force answer on about 97k random version/range pairs and 7.8.5 was wrong on around 13% of them.

Environment

• semver: 7.8.5 (same on main)
• Node: 22.17.1
• OS: Windows 11