Skip to content

Upgrading semver 6 to 7

Breaking6.3.1 → 7.8.5Security1Platform2New9Changed7Fixed46Other44

Full comparisonBack to semver
BreakingUpgrade verdict

2 platform requirement changes and a security fix.

In plain terms
  • The package can once more be installed and used on Node.js 10 and newer.
  • This version no longer runs on very old versions of Node.js, because it now uses modern JavaScript syntax.
  • semver vulnerable to Regular Expression Denial of Service
Must act 3 items need code or config changes

Requires Node.js >=10 from 7.3.7 (none stated before).

What you must change

Security1
semver vulnerable to Regular Expression Denial of Service
High · CVSS 7.5
7.5.2GitHub AdvisoryOriginalView source
Platform2
Allows Node.js versions >=10 again.
7.3.7GitHub ReleaseSummarizedView source
Drops support for very old Node versions and uses const/let, arrow functions, and classes.
7.0.0CHANGELOG.mdSummarizedView source