One version for everything. Every @stackra/* package releases at the same version (the changesets fixed
group), and @stackra-pro/* releases at that same version
(0453 decision
18). Install matching versions of all Stackra packages; mixing versions is not supported.
Semantic versioning. A patch fixes, a minor adds, a major breaks.
0.x. Before 1.0.0, as semver allows, a minor release may break an API. Every breaking release carries a
written release note (what changes for you, the steps to take, how to verify and roll back;
0013 decision 5).
A version is never replaced. A published version is immutable, also after a deprecation, and the registry
refuses unpublishing. A fix is a new version.
A deprecated API keeps working for one minor release before 1.0.0, and for one major release after
(0177 decision 6). A deprecated package version shows npm’s
deprecation warning with the version to move to.
Report a vulnerability privately, as Security overview says. Our
policy acknowledges a report within three business days (SECURITY.md). A fix ships as a new version; there is no
in-place patch of a published version.
