Follow DOMPurify versioning about isomorphic-dompurify HOT 4 CLOSED

I agree with you, its best we keep things simple right now until we really have a good use-case to do otherwise 👍 Good idea getting the smoke test up

from isomorphic-dompurify.

It's always nice to have someone to discuss things with and find an optimal solution together. Thanks for being open for that.
I will then close the issue for now.

from isomorphic-dompurify.

Unfortunately it looks like DOMPurify intentionally isn't using semantic versioning meaning that we will just have to do our own thing. I'm not sure how I feel about this, but another idea we had would be to DOMPurify's versioning and add an extra digit on the end for when we need to make bug fixes.

Ex: If DOMPurify is at v2.0.11, we could bump ourselves to v2.0.110. Then if we need to make any bug fixes ourselves we can increment the last digit ex: 2.0.111. It doesn't follow semantic versioning which is why i'm not sure how I feel about it, but would make it easier to for consumers of isomorphic-dompurify to know which version of DOMPurify they are using.

from isomorphic-dompurify.

@NicholasEllul I can guess why DOMPurify guys don't like the semantic versioning. It's probably because they constantly add small features/additions to their project. And the additions are too small to create minor versions.

Let's try to think as our users. As a user of isomorphic-dompurify, I would like my code to be sanitized at server and client sides. I don't want to know what are differences between 2.0.8 and 2.0.11 versions of DOMPurify unless it stops sanitizing my HTML. And my second need is I want it to be of the latest version to keep my code secure.

As for the sanitization, we have the smoke test which checks it. We can always develop more tests to ensure DOMPurify serves its main purpose well.

As for keeping DOMPurify dependency up to date, we now have Dependabot taking care of it, so this need is also covered with our current setup.

What I want to say is that we should be Okay without mirroring DOMPurify versions at least until our users ask us to do the opposite. What do you think?

from isomorphic-dompurify.