raszi / node-tmp

Temporary file and directory creator for node.js
MIT License
732 stars 93 forks source link

Semantic Versioning #258

Closed missinglink closed 3 years ago

missinglink commented 3 years ago

Hi,

I wanted to highlight an issue in how you specify your version number for breaking changes.

The specification adopted by most npm modules requires that breaking changes increment the major version number.

Recently there have been releases published under the versions 0.2.x when it should really be 1.x.x.

This helps downstream consumers better control which updates they accept automatically and which require manual review.

We were recently affected by this change because we use https://greenkeeper.io to automate our dependency updates, Greenkeeper also expected these to be non-breaking changes.

raszi commented 3 years ago

Hi @missinglink

First of all, I am sorry that the recent changes caused issues on your side.

We do understand the how Semantic Versioning is working that is the reason why tmp was not moved out from the 0 major version.

  1. Major version zero (0.y.z) is for initial development. Anything MAY change at any time. The public API SHOULD NOT be considered stable.

  2. Version 1.0.0 defines the public API. The way in which the version number is incremented after this release is dependent on this public API and how it changes.

This does not mean that we aren't planning to stabilize the current package and release the first major version, please see #158

missinglink commented 3 years ago

Okay thanks, I've decided to remove this module from our production dependencies but would consider using it again once the API becomes stable.

raszi commented 3 years ago

That is of course your decision since it is your codebase.

Although I am not sure I understand your concern. npm handles the version updates correctly if you have a dependency on a package where the major version has not yet reached 1, then on a minor or a patch version change npm update does not update this dependency automatically only if you manually change the version in your package.json for the specific package. Therefore breaking changes could only surface with your knowing.

silkentrance commented 3 years ago

@raszi thanks for clearing this up!