Repository navigation
Fix the due date on an issue that covers two versions - #121
Merged
Merged
Conversation
irskep
force-pushed
the
spec-due-date-floor-and-sibling-versions
branch
from
October 12, 2026 19:03
65c4165 to
58d75ce
Compare
irskep
changed the title
irskep
force-pushed
the
spec-due-date-floor-and-sibling-versions
branch
2 times, most recently
from
October 12, 2026 19:07
06e1e80 to
b5ffec1
Compare
irskep
changed the title
irskep
marked this pull request as ready for review
October 12, 2026 19:13
Say react 17 needs 17.0.5 with a 28-day threshold and react 18 needs 18.2.1 with a 10-day threshold. The issue asked for 18.2.1 but added the 28 days to its release date. It now uses the threshold that belongs to the version it asks for. VersionContext.dependencyVersions lists every version of the dependency with the packages on each, so a spec filing one issue per team can see what else that team is on. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
irskep
force-pushed
the
spec-due-date-floor-and-sibling-versions
branch
from
October 13, 2026 16:42
b5ffec1 to
8a22a34
Compare
mblair
approved these changes
Oct 13, 2026
A policy that files tickets for high and critical advisories wants the
release that fixes those, due four weeks after it shipped. The fix
version on a finding is the lowest release that fixes every advisory,
so a medium advisory fixed later moved the ask and the deadline to its
release. getFixVersion(store, name, version, { minSeverity: 'high' })
leaves the medium out.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three changes to issue specs, for Linear and GitHub.
When two versions of a dependency get specs with the same scope, they share one issue. The issue asks for the higher of their two
minimumVersions, but it used thethresholdDaysfrom whichever spec came first. Sayreact17 needs 17.0.5 with a 28-day threshold andreact18 needs 18.2.1 with a 10-day threshold. The issue asked for 18.2.1 and added the 28 days to its release date, so it was due weeks late. It now uses the threshold that belongs to the version it asks for.VersionContext.dependencyVersionslists every version of the dependency in the repo, with the packages on each. A spec that files one issue per team can see what else that team is on, so its versions agree on what to ask for. It is optional, likeusedBy, so existing specs do not change.getFixVersion(store, name, version, { minSeverity: 'high' })counts only the advisories at least that severe. Without it, a medium advisory fixed later than the high one moved the ask, and the due date, to its release. An advisory with no severity of its own takes the severity of its finding. A finding without per-advisory detail is counted or left out as a whole. Without the option, nothing changes.