"fixing" or "fixed" -- how should we name a package that fixes a vulnerability?

[johnmhoran]

A serious question. Please do contribute your thoughts. We will discuss on the next weekly jit.si.

• A vulnerability is "fixed by" a package.
• A vulnerability is "affecting" a package.
• A package is "fixing" a vulnerability.
• A package is "affected by" a vulnerability.

This is what we suggest after a discussion with @pombredanne .

TODO:

• Check the words used by NVD, GHSA, OSV et al./etc.

[mjherzog]

Please also check:

• CycloneDX
• SPDX (not sure if they have anything but they document many relationship pairs)
• Snyk
• Sonatype
• JFrog

[johnmhoran]

Thank you @mjherzog -- I'll do that.

[mjherzog]

It seems that the affect/fix terminology is well-established. I recommend slight changes in wording as follows:

• A vulnerability is "fixed by" a package.
• A vulnerability "affects" a package.
• A package "fixes" a vulnerability.
• A package is "affected by" a vulnerability.

[DennisClark]

I second the recommendation

[johnmhoran]

I will paste some screen shots here in a little while illustrating our decision at today's jit.si meeting to keep the naming as it is and has been for a while on my issue #1228 VCIO UI.

[johnmhoran]

Some representative examples. @DennisClark you'll like this first one. ;-)

[johnmhoran]

[johnmhoran]

[johnmhoran]

[johnmhoran]

[johnmhoran]

[johnmhoran]

I'm done.

[DennisClark]

@johnmhoran thanks for the concrete examples. I think that they illustrate the best approach to take.

[pombredanne]

Closed in favor of #1520