Upstream versions with '-' as '_', as mkhint stored them

'-' is illegal in a SlackBuild version, so dated tags like exploitdb's
2026-10-14 are packaged 2026_10_14 and showed as outdated forever.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 12 insertions, 3 deletions

diff --git a/docs/superpowers/specs/2026-10-20-sb-builder-phase4-design.md b/docs/superpowers/specs/2026-10-20-sb-builder-phase4-design.md
index c45c720..775b0c4 100644
--- a/docs/superpowers/specs/2026-10-20-sb-builder-phase4-design.md
+++ b/docs/superpowers/specs/2026-10-20-sb-builder-phase4-design.md
@@ -97,6 +97,9 @@ editing, migration of `NODOWNLOAD=yes` lines (none exist).
 - Result: `{pkg: version}` and `{pkg: error}` from the JSON log. A package
   without a result, or a failed run (exit status, stderr), shows as
   `nvchecker error` with the reason in the tooltip.
+- Upstream versions are stored with `-` as `_` (mkhint's `_normalize_version`):
+  `-` is illegal in a SlackBuild version, so upstream `2026-10-14` is
+  packaged `2026_10_14`. The comparison and `hint-update` use that form.
 - A package is outdated when its upstream version differs from the hint
   `VERSION`, or from the `.info` `VERSION` when the hint has none. Versions
   are compared as strings; no ordering is attempted.
diff --git a/sb_builder/upstream.py b/sb_builder/upstream.py
index d936706..1392563 100644
--- a/sb_builder/upstream.py
+++ b/sb_builder/upstream.py
@@ -53,7 +53,10 @@ def write_config(tmpdir, keyfile, path=STANZAS):
 
 
 def parse_log(text):
-    """({name: version}, {name: error}) from nvchecker --logger json output."""
+    """({name: version}, {name: error}) from nvchecker --logger json output.
+
+    Versions come back in the packaging form, '-' as '_', as mkhint did.
+    """
     versions, errors = {}, {}
     for line in text.splitlines():
         try:
@@ -63,7 +66,8 @@ def parse_log(text):
         if not isinstance(e, dict) or "name" not in e:
             continue
         if e.get("version"):
-            versions[e["name"]] = e["version"]
+            # '-' is illegal in a SlackBuild version: packaged as '_' (2026-06-02 -> 2026_06_02)
+            versions[e["name"]] = e["version"].replace("-", "_")
         elif e.get("level") == "error":
             errors.setdefault(e["name"], str(e.get("error") or e.get("event")))
     return versions, errors
diff --git a/tests/test_upstream.py b/tests/test_upstream.py
index 38cba54..3c64660 100644
--- a/tests/test_upstream.py
+++ b/tests/test_upstream.py
@@ -37,6 +37,7 @@ from sb_builder import upstream  # noqa: E402
 app = QApplication.instance() or QApplication([])
 LOG = "\n".join([
     '{"name": "borgbackup", "version": "1.4.5", "event": "updated", "level": "info"}',
+    '{"name": "exploitdb", "version": "2026-10-14", "event": "updated", "level": "info"}',
     '{"name": "bogus", "event": "unexpected error happened", "error": "HTTPError(404)", "level": "error"}',
     '{"name": "bogus", "event": "no-result", "error": "later", "level": "error"}',
     'not json',
@@ -71,7 +72,8 @@ class UpstreamTest(unittest.TestCase):
             self.assertEqual(tomllib.load(f)["__config__"], {"keyfile": keys})
 
     def test_parse_log(self):
-        self.assertEqual(upstream.parse_log(LOG), ({"borgbackup": "1.4.5"}, {"bogus": "HTTPError(404)"}))
+        self.assertEqual(upstream.parse_log(LOG), ({"borgbackup": "1.4.5", "exploitdb": "2026_10_14"},
+                                                   {"bogus": "HTTPError(404)"}))
 
     def test_state(self):
         names = {"a", "b", "c"}