schema-version: 0.1.0 standard: schema-version: 0.1.0 sequence: 232 standard_id: REL-003-JAVASCRIPT title: JavaScript Patch Version Naming summary: A JavaScript patched release is a SemVer prerelease of the maintainer's next patch version, so npm tooling sorts it above the release it patches and below the maintainer's own fix. extends: REL-003 doc-status: Draft standard-version: 0.1.0 candidate-pack: OSERA-SP-0.2.0 required ratified-in: Not ratified ratified-date: Not ratified fitness-role: Required JavaScript profile check type: REL category: Release Process applies-to: - JavaScript package patch providers - Enterprise JavaScript recipients - npm registry and dependency tooling requirements: - id: REL-003-JAVASCRIPT.REQ-001 override-explanation: Specializes the generic applicable-profile rule with the npm form. The default `+osera-patch.NNN` build metadata is excluded from precedence under SemVer and cannot be selected on npm, so the profile uses a prerelease of the next patch version instead; the parent obligations to identify the latest applicable remediation on the same upstream line and preserve baseline and OSERA identity remain. level: MUST text: Official OSERA JavaScript patched releases must be published under the upstream package name at a version of the form `..-osera-`, a SemVer prerelease of the version after the upstream baseline, where upstream has not released `..`. checkability: automated checks: - id: REL-003-JAVASCRIPT.CHECK-001 override-explanation: Replaces generic profile-selection evidence with the npm pattern and resolver evidence. The parent consumer outcome remains the acceptance criterion; the form is the one described below. title: npm patch version is a prerelease of the baseline's next patch and orders between the baseline and that patch type: release severity: blocking implementation: osera-fitness.rel003_javascript.version_pattern evidence: - release_tag - artifact_version - baseline_version - resolver_test_result - id: REL-003-JAVASCRIPT.CHECK-003 title: Upstream has not released the version the backpatch precedes, and the backpatch is not tagged latest type: release severity: blocking implementation: osera-fitness.rel003_javascript.upstream_headroom evidence: - artifact_version - upstream_versions - dist_tags - id: REL-003-JAVASCRIPT.REQ-002 override-explanation: Specializes the parent identifier-consistency obligation for npm packages by including npm package URLs. The same patched-release identity must still connect source tags, artifacts, feeds, and evidence. level: MUST text: JavaScript release tags, package versions, npm package URLs, vulnerability feeds, and release evidence must carry the same patched version identifier. checkability: automated checks: - id: REL-003-JAVASCRIPT.CHECK-002 override-explanation: Uses npm package URL evidence for the parent consistency check while retaining release-tag, artifact-version, and feed identity matching. title: JavaScript release identifier is consistent across source, package, and feeds type: release severity: blocking implementation: osera-fitness.rel003_javascript.identifier_consistency evidence: - release_tag - artifact_version - npm_purl - feed_purl - id: REL-003-JAVASCRIPT.REQ-003 level: MUST text: Each backpatch on a baseline must carry every fix of the backpatches published before it on that baseline. checkability: automated checks: - id: REL-003-JAVASCRIPT.CHECK-004 title: A backpatch closes every vulnerability its predecessors on the same baseline closed type: release severity: blocking implementation: osera-fitness.rel003_javascript.cumulative evidence: - artifact_version - previous_backpatch_versions - vulnerability_statements source_path: docs/_standards/rel-003-javascript-patch-version-naming.md url: "/standards/rel-003-javascript-patch-version-naming/" parent_relationship: parent_standard: REL-003 parent_version: 0.1.0 requirements: - parent_item: REL-003.REQ-001 treatment: Overrides effective_item: REL-003-JAVASCRIPT.REQ-001 explanation: Specializes the generic applicable-profile rule with the npm form. The default `+osera-patch.NNN` build metadata is excluded from precedence under SemVer and cannot be selected on npm, so the profile uses a prerelease of the next patch version instead; the parent obligations to identify the latest applicable remediation on the same upstream line and preserve baseline and OSERA identity remain. - parent_item: REL-003.REQ-002 treatment: Overrides effective_item: REL-003-JAVASCRIPT.REQ-002 explanation: Specializes the parent identifier-consistency obligation for npm packages by including npm package URLs. The same patched-release identity must still connect source tags, artifacts, feeds, and evidence. - parent_item: treatment: Added effective_item: REL-003-JAVASCRIPT.REQ-003 explanation: Each backpatch on a baseline must carry every fix of the backpatches published before it on that baseline. checks: - parent_item: REL-003.CHECK-001 treatment: Overrides effective_item: REL-003-JAVASCRIPT.CHECK-001 explanation: Replaces generic profile-selection evidence with the npm pattern and resolver evidence. The parent consumer outcome remains the acceptance criterion; the form is the one described below. - parent_item: REL-003.CHECK-002 treatment: Overrides effective_item: REL-003-JAVASCRIPT.CHECK-002 explanation: Uses npm package URL evidence for the parent consistency check while retaining release-tag, artifact-version, and feed identity matching. - parent_item: treatment: Added effective_item: REL-003-JAVASCRIPT.CHECK-003 explanation: Upstream has not released the version the backpatch precedes, and the backpatch is not tagged latest - parent_item: treatment: Added effective_item: REL-003-JAVASCRIPT.CHECK-004 explanation: A backpatch closes every vulnerability its predecessors on the same baseline closed