Re:"Is This Project Still Maintained?"
by throwaway11460 on Thursday May 16, 2024 @07:02AM
(#40376990)
That's why we use Semver, at least in the Node land. A security fix should be a patch, at most minor version bump - API/behavior shouldn't change.
This doesn't change the fact that some security fixes forces behavioral changes, and semver doesn't protect you against that.
You fix the bug, and the behavior changes, because your design was wrong in the first place. Now there is at least one library which depends on that behavior so bad, so they can't change their dependency chain in two days.
The problem is inclusion of that much libraries creates a dependency hell, because a higher level library pulls in approximately 5 more libraries which are generally shared amongst other libraries you potentially pull.
Library A updates its' dependency to library C to a new, more recent minimum, but library B depends on C's behavior which is recently changed. Hence A requires C > v3, but B requires C==v2. Then the fun begins.
Bonus points for having a serious CVE/RCE as a reason for updating C to v3 in the first place.