Why we don't have 2.x branch

[mayurvandra]

The reason I am asking that question because of High severity vulnerabilities / serve-handler / path-to-regexp vercel/serve#811

serve-test@1.0.0
└─┬ serve@14.2.3
└─┬ serve-handler@6.1.5
└── path-to-regexp@2.2.1

This package is using path-to-regexp@2.2.1 and the recent commit for (Add backtrack protection to 3.x release) was done for 3.x release but I don't see any new package version for 2.x.

[blakeembrey]

There's no 2.x branch for the same reason as many other versions don't have branches, I didn't have the capacity to patch every version. I'd recommend either upgrading or downgrading. The CHANGELOG for 3.x is here: https://github.com/pillarjs/path-to-regexp/blob/2eb12934fc1f15d3b9bad010709717fc53a14b8e/History.md, it just depends what features were being used. From a brief look it appears they could downgrade to 1.x without impacting anyone. Alternatively if they want to use the safe APIs, the only truly safe path would be the 8.x releases.

[blakeembrey]

The breaking change from that history file appears to be:

Remove asterisk functionality

There's code in serve-handler that appeared to try and add that back anyway: https://github.com/vercel/serve-handler/blob/17f3f7e70a7f54b4f82c9c18376969fa15810c6e/src/index.js#L46

It also looks reasonably safe to bump to 3.0, as the only breaking change there was the prefix characters.

[cylewaitforit]

Because serve-handler is pinned to 2.2.1 and not using something like ^2.2.1 a new version of path-to-regexp on the 2.x branch wouldn’t make much of a difference anyway. In all normal upgrade paths a new version of Serve-Handler and Serve is needed.

The solution if Vercel doesn’t upgrade those packages is using an alternative to Serve or adding an override/resolution in package.json to force a later version of path-to-regexp.

[mayurvandra]

Thank you for the clarification. You guys are the best!