
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
semver-range
Advanced tools
npm package (research tool) to help with comparison of semantic version ranges (semver).
For example you can use this tool if you want to compare ^4.0.x and 4.x which is technically no change in the version.
const semverCompare = require('./semver-range').semverCompare;
const semverDiff = require('./semver-range').semverDiff;
console.log('^4.0.x AND 4.x: ', semverCompare('^4.0.x', '4.x'), '~', semverDiff('^4.0.x', '4.x'));
// output:
// ^4.0.x AND 4.x: not_changed ~ other
see test.js for more examples, and run npm test to print examples to stdout.
In some cases it's hard to tell if a change of version will actually result in an upgrade or downgrade and it can be different depending on the package. To resolve this issue I made some assumptions which you should consider if you use this package. It is as described bellow: When comparing v1 and v2, Each range has an upper bound and a lower bound.
v2.upper is decreased and v2.lower is increased it can be upgrade or downgrade depending on the latest version of that specific package o
n npm.v1 or v2 is a latest, stable, etc then it will be categorized as 'other'!v2.lower and/or v2.upper is increased (May not be an upgrade depending on latest version of that specific package o
n npm.)v2.upper is decreased (May not be an downgrade depending on latest version of that specific package o
n npm.)TO-DO:
FAQs
A package to help with comparison/diff of semantic version ranges
The npm package semver-range receives a total of 3 weekly downloads. As such, semver-range popularity was classified as not popular.
We found that semver-range demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.