3 ms·
That's why we use Semver, at least in the Node land. A security fix should be a patch, at most minor version bump - API/behavior shouldn't change.
by throwaway11460 2y ago
That's why we use Semver, at least in the Node land. A security fix should be a patch, at most minor version bump - API/behavior shouldn't change.
- bayindirh 2y agoThis doesn't change the fact that some security fixes forces behavioral changes, and semver doesn't protect you against that. You fix the bug, and the behavior changes, because your design was wrong in the first place. Now there is at least one library which depends on that behavior so bad, so they can't change their dependency chain in two days.