Skip to content

Improve affected/patched version readablity in security release blog posts - #2497

Merged
bjohansebas merged 1 commit into
expressjs:mainfrom
krzysdz:security-blog-formatting
Sep 2, 2026
Merged

bjohansebas merged 1 commit into
expressjs:mainfrom
krzysdz:security-blog-formatting

Conversation

@krzysdz

@krzysdz krzysdz commented Aug 31, 2026 •

Copy link
Copy Markdown
Contributor

Note

This is more of a request for comments than a proper PR.

Recent blog posts about security releases put the list of affected and patched versions in the same line (in rendered docs, source has them separate). On smaller screens the text wrapping makes it look a bit weird and hard to follow.

The text "Affected versions: < 1.12.0 Patched version: >= 1.12.0" that is wrapped after the word "patched"
CVE-2026-15603 details from the August 2026 post viewed on a phone
A very long text with affected and patched versions, where the "Patched version:" bold text is somewhere in the middle of paragraph
CVE-2026-5038 details from the June 2026 post viewed on a phone

Some older posts follow a slightly different format:

  • September 2024 mixes two different approaches:
    • separate paragraphs
      Affected versions and patched versions as separate paragraphs
    • lists
      "Affected versions" text followed by an unordered list of versions and below separately the same for patched versions
  • July 2025 has a <br> (double space at the end of line in markdown) separating the affected versions and patched versions
    Affected versions and patched version in separate line, but same paragraph

Good readable format

At the time of creation of this PR it adds line breaks between all affected and patched version lines that were rendered in one line. It looks better on mobile and desktop, but in cases when there are multiple versions listed I think that a proper list would be more readable.

A very long text with affected versions and separated by a line break a long text with patched versions
This PR version of CVE-2026-5038 details from the June 2026 post viewed on a phone (compare to the original above)

Question(s)

A few more or less related questions that I had while writing this:

  1. Should we decide on one format? Which one?
  2. Some multer security-related patches have been cherry picked to the v3 branch (June 2026) and released in a new alpha, while others (August 2026) are exclusive to the stable 2.x branch. Is that on purpose?
  3. (nitpick) Why do posts from 2025 (and only 2025) capitalise the first letter of all package names?

@krzysdz
krzysdz requested a review from a team as a code owner August 31, 2026 23:00
@netlify

netlify Bot commented Aug 31, 2026 •

Copy link
Copy Markdown

✅ Deploy Preview for expressjscom-preview ready!

Name Link
🔨 Latest commit b3ae3c2
🔍 Latest deploy log https://app.netlify.com/projects/expressjscom-preview/deploys/6a960778d6a41e000811b4d8
😎 Deploy Preview https://deploy-preview-2497--expressjscom-preview.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
Lighthouse
Lighthouse
1 paths audited
Performance: 99 (🟢 up 2 from production)
Accessibility: 100 (no change from production)
Best Practices: 100 (no change from production)
SEO: 100 (no change from production)
PWA: 80 (no change from production)
View the detailed breakdown and full score reports
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@krzysdz
krzysdz requested review from a team and UlisesGascon August 31, 2026 23:02
@bjohansebas
bjohansebas merged commit 03529d1 into expressjs:main Sep 2, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants