[Aschenbath]

A range such as pnpm@9 can select 9.1.0-0, and corepack up can move a stable project onto that prerelease. Registry resolution currently removes prerelease components while testing ranges; it also accepts a prerelease below an explicitly requested prerelease lower bound.

Use semver's standard range matcher for registry candidates, consistent with cache lookup. Exact prerelease versions, tags, and ranges that explicitly include prereleases remain supported. When the version selected by corepack up is a prerelease, keep that version as the lower bound within its major release line. This permits newer prereleases with the same major/minor/patch numbers and newer stable releases, without downgrading to an older stable version.

Package-manager configuration lookup retains its existing matcher so that explicitly selected development releases still resolve their binary layout correctly. The README describes registry range and upgrade behavior.

Fixes #473.
Fixes #774.

Validation on Node.js 22.23.3 in WSL:

• corepack yarn build, corepack yarn typecheck, and corepack yarn lint --max-warnings=0 passed.
• NOCK_ENV=replay corepack yarn test run --retry=0: 185 passed and one existing expected failure across nine files.
• Fourteen CLI regressions pass against the local registry fixture, covering stable selection for use, global installation and up; explicit prerelease versions/ranges/tags; prerelease upgrades and promotion to stable; and rejection of out-of-range versions or downgrades. Rejected requests leave the manifest unchanged.
• The fork Tests workflow passed all ten jobs on fc545280df617b575dba235206c43d3d43d50ed1: static checks and Node.js 22/24/26 across Linux, macOS, and Windows. All nine platform jobs ran and passed the fourteen prerelease regressions. The upstream workflow is awaiting maintainer approval.

The registry fixture serves opt-in prerelease versions and parses tarball names containing prerelease hyphens. Its ordinary version lists and signature checks remain in place. The full suite also passes the existing pnpm development-release binary-layout tests.

Implementation and automated validation were performed by Codex.

[aduh95]

This account has opened more than 10 PRs in the last 24 hours. This looks like bot activity, and will result in a ban if the behavior continues.