fix(spec): Require opt-in for pre-release

src/cargo/core/package_id_spec.rs

@@ -470,9 +470,9 @@ mod tests {
 
         let pre = PackageId::new("pre", "1.2.3-alpha.0", sid).unwrap();
         assert!(PackageIdSpec::parse("pre").unwrap().matches(pre));
-        assert!(PackageIdSpec::parse("pre@1").unwrap().matches(pre));
-        assert!(PackageIdSpec::parse("[email protected]").unwrap().matches(pre));
-        assert!(PackageIdSpec::parse("[email protected]").unwrap().matches(pre));
+        assert!(!PackageIdSpec::parse("pre@1").unwrap().matches(pre));
+        assert!(!PackageIdSpec::parse("[email protected]").unwrap().matches(pre));
+        assert!(!PackageIdSpec::parse("[email protected]").unwrap().matches(pre));
         assert!(PackageIdSpec::parse("[email protected]")
             .unwrap()
             .matches(pre));

src/cargo/util/semver_ext.rs

@@ -187,6 +187,11 @@ impl PartialVersion {
     /// Build metadata does not affect version precedence but may be necessary for uniquely
     /// identifying a package.
     pub fn matches(&self, version: &Version) -> bool {
+        if !version.pre.is_empty() && self.pre.is_none() {
+            // Pre-release versions must be explicitly opted into, if for no other reason than to
+            // give us room to figure out and define the semantics
+            return false;
+        }
         self.major == version.major
             && self.minor.map(|f| f == version.minor).unwrap_or(true)
             && self.patch.map(|f| f == version.patch).unwrap_or(true)