Re:What NPM should do to stop a new colors attack
by acdha on Monday January 10, 2022 @07:02PM
(#29885024)
Yes, if someone chooses not to follow semver correctly they can create problems but there are a somewhat unlimited number of ways in which an untrustworthy maintainer can do that. The difference is that following semver means it's easy to not do that since they can always ship 2.<latest + 1> with no changes other than the security fix.
Re:What NPM should do to stop a new colors attack
by zkldi on Monday January 10, 2022 @09:14PM
(#29886379)
This is following semver correctly. A PATCH update may be a MAJOR update (since its a superset) and it may be considered a breaking change.
Re:What NPM should do to stop a new colors attack
by johannes1234321 on Monday January 10, 2022 @07:17PM
(#29885193)
> The difference is that following semver means it's easy to not do that since they can always ship 2.<latest + 1> with no changes other than the security fix.
If the line between bug and feature were clear. (Log4j worked 100% as specified btw. in regards to log4shell)
You still have the exact same problem you described with `^2.14.0`. Someone would have to manually update the package to get the security fix in 3.0.0.
Unless you're suggesting code should also automatically update major versions aswell?