releases available via npm

[piotr-gawron]

I just found out that currently only the latest version of ecstatic is available via npm:

$ npm view ecstatic versions  --json
[
  "4.1.2"
]

Could you make the older versions available as well? There are a lot of libraries that are using this module and removing older version can break the build.

[thornjad]

@jfhbrook even though older version are insecure, this is entirely breaking installing http-server. Could even just one 3.x version stay published for now? If npm allows specific versions to be deprecated, that would be a good way to signal the issue.

[Blackbaud-PaulCrowder]

Or perhaps backport the security fix to 3.x and 2.x so that the Internet is no longer broken. This is having ripple effects across a huge number of consumers right now.

[thornjad]

Is be6fc25 the security fix? It looks like it could be quickly and easily backported to a new 3.3.2

[jfhbrook]

I’m on the road but can probably look at this tomorrow morning. In the meantime that is in fact the fix if you want to try backporting to 3.x - I can publish.

[thornjad]

@jfhbrook that commit is titled Ho hum and is the only commit between 4.1.1 and 4.1.2. Does that seem right for the fix?

[jfhbrook]

Yes that’s the correct commit.

[thornjad]

#256 beat me to it, thanks @Blackbaud-ShaydeNofziger