search

Psifi-Solutions / csrf-csrf

A utility package to help implement stateless CSRF protection using the Double Submit Cookie Pattern in express.
Other
123 stars 19 forks source link

3.0.6 version in npm? #66

Closed seancolyer closed 3 months ago

seancolyer commented 5 months ago

It looks like latest code in the repo is 3.0.4, and changelog reflects that as well. npm has package.json with 3.0.6 and potentially other changes (haven't done a deep dive).

Do you know what's going on?

psibean commented 5 months ago

Yes.

I fucked up a bit with the TypeScript side of things with version 3.0.4, this means 3.0.4 types are broken, I also fucked up the 3.0.5 attempt to fix it. 🤦🏻

As a result, I created a v3.x.x branch, which has the 3.0.5 & 3.0.6 changes.

The eventual plan is to have a workflow branching strategy such that supported versions will automatically open upstream PR's to have master updated with changes that target previous versions.

However, currently, the build using tsup is still broken for the TypeScript declaration in both 3.0.6 and master - I had to make some manual tweaks to the build output to make it work (for now). It's absolutely insane how bad the TypeScript compilation is, even with tsup, it just doesn't work as intended at all and it's infuriating.

So 3.0.6 is the version you should be using, find it at the v3.x.x branch.

Once I fix the compilation and wire up the branching, master will eventually catch up.

Going forward I plan to use vx.x.x branches for each version, and master will remain as a "next major" branch. So once v4 releases, it'll be running off v4.x.x, I'll be sure to have the README updated to reflect this as well once it's ready.

psibean commented 3 months ago

I've set things up a bit better and I'll make sure fixes / changes to v3.x.x get merged up to master.

seancolyer commented 3 months ago

I've set things up a bit better and I'll make sure fixes / changes to v3.x.x get merged up to master.

Thanks for getting this sorted out!