News for hackers. Stuff that matters.

A comment on "Is This Project Still Maintained?". Parent comment

Re:"Is This Project Still Maintained?" by throwaway11460 on Thursday May 16, 2024 @07:02AM (#40376990)
That's why we use Semver, at least in the Node land. A security fix should be a patch, at most minor version bump - API/behavior shouldn't change.
[ Parent | on HN ]
Re:"Is This Project Still Maintained?" by bayindirh on Thursday May 16, 2024 @07:05AM (#40377017)
This doesn't change the fact that some security fixes forces behavioral changes, and semver doesn't protect you against that.

You fix the bug, and the behavior changes, because your design was wrong in the first place. Now there is at least one library which depends on that behavior so bad, so they can't change their dependency chain in two days.

[ Parent | on HN ]