Skip to content

proposal: support limiting results to security releases #5

Closed
@knksmith57

Description

@knksmith57

Back in May, the node.js Releases team added a new security property to the index (nodejs/nodejs-dist-indexer#9).

The property is a boolean that indicates if the release is a security release, which is useful for a few reasons (many described in nodejs/Release#437 (comment)); the one that I believe justifies adding functionality to resolve-node is this one (emphasis mine):

Theoretically, developers (us included!) could use this in a few ways:
...

  • loop over every release in a release line until they encounter true – when they encounter true for the first time, they know that version is the minimum secure version

The proposal is to add support for a security query param on all endpoints that causes the eligible list of versions to be filtered by security === true before applying the maxSatisfying() query.

eg:

$ curl https://resolve-node.now.sh/lts/dubnium
v10.17.0

$ curl https://resolve-node.now.sh/lts/dubnium?security=true
v10.16.3

This tells us that, at the time of the query, anyone running Dubnium < 10.16.3 is on a known, potentially insecure version.

what do y'all think? should I whip together a PR?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions