alt Hacker NewsWhy would you patch a security vuln in a later version? Should be patched in all versions.. that's what semver is for.
Replies
raincole • today at 1:56 AM
Who is 'you' here? All of the npm package maintainers?
Yes, if they all just backport security patches we'll be fine. No, people are not going to just.
jpleger • today at 1:03 AM
Ah yes the incredibly common practice of... checks notes backporting security packages in node packages.
kijin • today at 1:04 AM
Semver doesn't help if you just declare all older versions EOL.
What you're looking for are Debian stable packages. :p
A patch updates is a newer version, and they are just as likely to be compromised by supply chain attacks as minor or major updates.