Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by bfivyvysj on Thursday April 23, 2026 @08:10PM
(#47883897)
Why would you patch a security vuln in a later version? Should be patched in all versions.. that's what semver is for.
[ Parent
| on HN ]
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by jpleger on Thursday April 23, 2026 @09:03PM
(#47884282)
Ah yes the incredibly common practice of... checks notes backporting security packages in node packages.
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by kijin on Thursday April 23, 2026 @09:04PM
(#47884285)
Semver doesn't help if you just declare all older versions EOL.
What you're looking for are Debian stable packages. :p
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by raincole on Thursday April 23, 2026 @09:56PM
(#47884600)
Who is 'you' here? All of the npm package maintainers?
Yes, if they all just backport security patches we'll be fine. No, people are not going to just.
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by pavon on Thursday April 23, 2026 @10:47PM
(#47884885)
A patch updates is a newer version, and they are just as likely to be compromised by supply chain attacks as minor or major updates.
Re:Bitwarden CLI Compromised in Ongoing Checkmarx Supply Cha...
by dsl on Friday April 24, 2026 @02:45AM
(#47886491)
Not exactly.
Security patches aren't like bugs or features where you can just roll a new version. Often patches need to be backported to older versions allowing software and libraries to be "upgraded" in place with no other change introduced.
Say you had software that controlled the careful mix of chemicals introduced into a municipal water supply. You just don't move from version 1.4 to 3.2, you fix 1.4 in place.