Three digits, three rules: reading a version bump
Semantic Versioning says: MAJOR for incompatible API changes, MINOR for backward compatible functionality, PATCH for backward compatible fixes. Version 0.y.z is special: anything may change at any time.
Rails uses Major.Minor.Patch too, but its upgrade guide says Major and Minor may change the public API. Only Patch is limited to bug fixes.
OpenSSL from 3.0 guarantees API/ABI compatibility within a MAJOR number, and says outright that it hasn't adopted semantic versioning in the strict sense.
| Bump | Semver project | Rails |
|---|---|---|
| 1.9.0 to 1.10.0 | Compatible | Public API may change |
| 0.4.1 to 0.5.0 | Anything may change | — |
Example
Illustrative. 12 dependencies get a bump. Sort them by each project's own rule: 8 are patch-only, 3 are minors from projects that allow API changes, 1 is on 0.y.z. The last 4 get a real review.
Important
Before you auto-merge, read the project's versioning page. Three digits alone don't tell you it's semver.
Before you auto-merge
- ☐ Check each project's versioning policy
- ☐ Treat 0.y.z as breaking
- ☐ Group bumps by risk
- ☐ Run tests per group
Weighted decision matrix — score update risk →
Source: semver.org; guides.rubyonrails.org, Upgrading Ruby on Rails; openssl-library.org, Release Strategy.