Filter out Go prerelease versions unless --prerelease is used

Go modules were offering prerelease updates by default because the Go
code path in findNewVersion() only filtered pseudo-versions but not
actual prerelease tags. Also, per-package --prerelease matching was
broken for Go because the data objects lacked a `name` property.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: silverwind

fixtures/go-prerelease/go.mod

@@ -24,6 +24,7 @@ const goUpdateModFile = fileURLToPath(new URL("fixtures/go-update/go.mod", impor
 const goUpdateMainFile = fileURLToPath(new URL("fixtures/go-update/main.go", import.meta.url));
 const goUpdateV2ModFile = fileURLToPath(new URL("fixtures/go-update-v2/go.mod", import.meta.url));
 const goUpdateV2MainFile = fileURLToPath(new URL("fixtures/go-update-v2/main.go", import.meta.url));
+const goPreFile = fileURLToPath(new URL("fixtures/go-prerelease/go.mod", import.meta.url));
 const dualFile = fileURLToPath(new URL("fixtures/dual", import.meta.url));
 const invalidConfigFile = fileURLToPath(new URL("fixtures/invalid-config/package.json", import.meta.url));
 
@@ -182,6 +183,7 @@ beforeAll(async () => {
     {path: "/github.com/example/testpkg/@latest", response: JSON.stringify({Version: "v1.0.0", Time: "2024-01-01T00:00:00Z"})},
     {path: "/github.com/example/testpkg/v2/@latest", response: JSON.stringify({Version: "v2.0.0", Time: "2025-01-01T00:00:00Z"})},
     {path: "/github.com/google/uuid/v2/@latest", response: JSON.stringify({Version: "v2.0.0-20260217135312-8c5a7de9ffa1", Time: "2026-02-17T13:53:12Z"})},
+    {path: "/github.com/example/prerelpkg/@latest", response: JSON.stringify({Version: "v1.1.0-rc.1", Time: "2025-06-01T00:00:00Z"})},
   ];
   for (let v = 71; v <= 82; v++) {
     goProxyRoutes.push({
@@ -1199,6 +1201,45 @@ test.concurrent("go update v1 to v2", async ({expect = globalExpect}: any = {})
   expect(updatedMain).not.toMatch(/"github\.com\/example\/testpkg"(?!\/v2)/);
 });
 
+test.concurrent("go prerelease excluded by default", async ({expect = globalExpect}: any = {}) => {
+  // Without --prerelease, Go prerelease versions should not be offered
+  expect(await makeTest(`-j -f ${goPreFile}`)()).toMatchInlineSnapshot(`undefined`);
+});
+
+test.concurrent("go prerelease with -p flag", async ({expect = globalExpect}: any = {}) => {
+  // With global --prerelease, Go prerelease versions should be offered
+  expect(await makeTest(`-j -f ${goPreFile} -p`)()).toMatchInlineSnapshot(`
+    {
+      "go": {
+        "deps": {
+          "github.com/example/prerelpkg": {
+            "info": "https://github.com/example/prerelpkg",
+            "new": "1.1.0-rc.1",
+            "old": "1.0.0",
+          },
+        },
+      },
+    }
+  `);
+});
+
+test.concurrent("go prerelease with -p per-package", async ({expect = globalExpect}: any = {}) => {
+  // With per-package --prerelease, Go prerelease versions should be offered for that package
+  expect(await makeTest(`-j -f ${goPreFile} -p github.com/example/prerelpkg`)()).toMatchInlineSnapshot(`
+    {
+      "go": {
+        "deps": {
+          "github.com/example/prerelpkg": {
+            "info": "https://github.com/example/prerelpkg",
+            "new": "1.1.0-rc.1",
+            "old": "1.0.0",
+          },
+        },
+      },
+    }
+  `);
+});
+
 test.concurrent("pin", async ({expect = globalExpect}: any = {}) => {
   const {stdout, stderr} = await nanoSpawn(process.execPath, [
     script,

index.test.ts

@@ -562,7 +562,7 @@ function parseGoMod(content: string): Record<string, string> {
 }
 
 async function fetchGoVcsInfo(name: string, type: string, currentVersion: string, goCwd: string): Promise<PackageInfo> {
-  const noUpdate: PackageInfo = [{old: currentVersion, new: currentVersion}, type, null, name];
+  const noUpdate: PackageInfo = [{name, old: currentVersion, new: currentVersion}, type, null, name];
   const currentMajor = extractGoMajor(name);
 
   const goListQuery = async (modulePath: string, timeout: number) => {
@@ -622,6 +622,7 @@ async function fetchGoVcsInfo(name: string, type: string, currentVersion: string
   }
 
   return [{
+    name,
     old: currentVersion,
     new: stripv(highestVersion),
     Time: highestTime,
@@ -632,7 +633,7 @@ async function fetchGoVcsInfo(name: string, type: string, currentVersion: string
 }
 
 async function fetchGoProxyInfo(name: string, type: string, currentVersion: string, goCwd: string): Promise<PackageInfo> {
-  const noUpdate: PackageInfo = [{old: currentVersion, new: currentVersion}, type, null, name];
+  const noUpdate: PackageInfo = [{name, old: currentVersion, new: currentVersion}, type, null, name];
 
   if (isGoNoProxy(name)) return fetchGoVcsInfo(name, type, currentVersion, goCwd);
 
@@ -697,6 +698,7 @@ async function fetchGoProxyInfo(name: string, type: string, currentVersion: stri
   }
 
   return [{
+    name,
     old: currentVersion,
     new: stripv(highestVersion),
     Time: highestTime,
@@ -1128,10 +1130,12 @@ function findNewVersion(data: any, {mode, range, useGreatest, useRel, usePre, se
   } else if (mode === "go") {
     const oldVersion = coerceToVersion(range);
     if (!oldVersion) return null;
+    const effectiveUsePre = usePre || isRangePrerelease(range);
+    const skipPrerelease = (v: string) => isVersionPrerelease(v) && (!effectiveUsePre || useRel);
 
     // Check cross-major upgrade
     const crossVersion = coerceToVersion(data.new);
-    if (crossVersion && !isGoPseudoVersion(data.new)) {
+    if (crossVersion && !isGoPseudoVersion(data.new) && !skipPrerelease(data.new)) {
       const d = diff(oldVersion, crossVersion);
       if (d && semvers.has(d)) {
         return data.new;
@@ -1140,7 +1144,7 @@ function findNewVersion(data: any, {mode, range, useGreatest, useRel, usePre, se
 
     // Fall back to same-major upgrade
     const sameVersion = coerceToVersion(data.sameMajorNew);
-    if (sameVersion && !isGoPseudoVersion(data.sameMajorNew)) {
+    if (sameVersion && !isGoPseudoVersion(data.sameMajorNew) && !skipPrerelease(data.sameMajorNew)) {
       const d = diff(oldVersion, sameVersion);
       if (d && semvers.has(d)) {
         data.Time = data.sameMajorTime;