304396 - Updates should have severities

Status: RESOLVED WONTFIX

(addons.mozilla.org Graveyard :: Developer Pages, enhancement)

Description

[alanjstr]

If an extension update fixes a serious bug, like a security bug, there should be
a way to convey its importance.

Comment 1

[Robert Strong (they/them - no direct email)]

Besides the technical implementation consistent criteria for deciding the severities will have to be defined for this to provide value.

Comment 2

[Michael Morgan [:morgamic]]

Mass change - bugs to be read / (re)confirmed.

Comment 3

[Michael Morgan [:morgamic]]

This would require the addition of a flag to the versions table, possibly versions.securityupdate, 1/0.

That could trigger the existence of an RDF element, something like:
<em:severity>major</severity>

Comment 4

[Michael Morgan [:morgamic]]

We also need to figure out what to do about:
* non-AMO add-ons -- do we allow them to be "major" when updating?
* subsequent versions -- if 3.1 is a major update, what happens when 3.2 is released and the user has 3.0?  must find a way to make 3.2 inherit the major flag, but only for versions < 3.1.

See bug 304397 comment #2 and bug 304397 comment #5.

Comment 5

[alanjstr]

I see no reason for non-AMO add-ons to not have "major".  This is to notify a user that there's a security vulnerability.  We don't want them to be insecure just because they don't use AMO.

Comment 6

[Wil Clouser [:clouserw]]

If this gets support in the client we can reopen.