[jpdefo]

What / Why

Main-version increments can exceed the numeric limit enforced by the constructor and return versions that the same package rejects:

const semver = require('semver')
semver.inc('1.2.9007199254740991', 'patch')
// Before: '1.2.9007199254740992'
// After: null

semver.valid('1.2.9007199254740992') is null. Repeated increments of the same instance can then stop advancing because of numeric precision. This affects extreme component values accepted by the parser.

Change and scope

Guard main-component increments against MAX_SAFE_INTEGER, using the constructor's existing TypeError messages. The public inc() wrapper retains its existing null failure convention. Check before resetting lower components or clearing prerelease information so a rejected increment leaves the instance unchanged.

All seven affected release modes are covered, together with successful increments to the limit, prerelease promotion without a component increment, and resets of large lower components. Numeric prerelease identifier arithmetic is unchanged. That is the separate subject of #916.

The CLI's existing invalid-increment handling is unchanged: it prints the API's null result and exits 0. This patch fixes the library's increment result and class state, without changing CLI exit semantics.

Validation

Executed on native Windows x64 with Node 24.15.0 and npm 11.12.1, against main 6e05b7637396ac66522cff8731f07cfe0ef49a29:

• New class/public-increment regressions before the source change: 50 failing and 1,462 passing assertions.
• npm test -- --reporter=terse: all 51 files and 9,357 assertions pass. Statement, branch, function and line coverage are all 100%. The command's ESLint and template-oss-check stages also pass.
• An independent baseline/candidate comparison covered 1,536 combinations of ordinary and boundary components, suffixes and release modes. All previously valid results were preserved. All 262 overflowing cases now throw without mutating the instance.
• git diff --check: passed.

No dependencies or generated tooling were changed. No matching main-component overflow issue or PR was found in pre-submission searches. Prepared with Codex assistance and reviewed independently by four Luna agents and one Sol agent. These reviews supplement the executed tests. Hosted CI and maintainer review are still pending.