multiroot vuln fix & 4.0.0-beta.X & beta dist-tag versus latest dist-tag

[srd90]

It seems that npm picks version up to dist-tag ”latest” automatically. I.e. semver resolution considers version with dist-tag ”latest” most recent stable to be selected if other version selection conditions are met.

At the moment (October 18th 2022) @node-saml/node-saml and @node-saml/passport-saml packages' dist-tags point to:

• @node-saml/node-saml
  • latest --> 4.0.0-beta.3
  • beta --> 4.0.0-beta.6
• @node-saml/passport-saml
  • latest --> 4.0.0-beta.1
  • beta --> 4.0.0-beta.4

Those who have these (or one of these) in package.json:

"@node-saml/node-saml": "^4.0.0-beta.3",
"@node-saml/passport-saml": "^4.0.0-beta.1",

might think that they are getting fix for GHSA-m974-647v-whv7 by running npm install. They won't.

If they do not pay attention to content of package-lock.json or npm audit warnings after npm install they end up still having vulnerable versions.

There are breaking changes between beta releases which could be the reason why only initial version per @node-saml scoped packages are dist-tagged with ”latest” because developers had to make explicit decision to jump to 4.0.0-beta.X from previous version and to resolve issues caused by breaking changes. Having said that and in the light of multiroot vuln and jumping to beta track in the first place could it be good idea to change dist-tag ”latest” to point to versions which have fix to aforementioned vulnerability?

This post is not based on pure speculation/imagination how things could play out with current dist-tags, versions and content of package.json.

@cjbarth @markstos

PS. dunno why list both dependencies if @node-saml/passport-saml is on the list because it exports also everything from @node-saml/node-saml
https://github.com/node-saml/passport-saml/blob/v4.0.0-beta.4/src/index.ts#L11
and @node-saml/passport-saml's package.json refers proper @node-saml/node-saml but thats the way things seems to be at some places.

[cjbarth]

I think the best solution to this is to just release the final version. I'll care for that soon.