Personally I'm frequently rug pulled by breaking changes in patch updates.
Imo, semver is just a way for lazy devs to break backwards compat and feel ok about it.
Which would be fine if they maintained their old versions, which of course they don't, so what's the point of semver? All the breaking change version change means to me is you've forked your library and left me holding the bag.
I either have to update my code to accommodate your changes or I need to change your code to accommodate security issues.
And fuck me sideways if I have you as a peer dependency.
Is there a better alternative?
And yes, of course they would have, but at least they wouldn't be able to lie about what theyre doing.
There is a better alternative, maintain backwards compatibility. And if you break it, acknowledge what you're doing, forking your lib and leaving everyone who relied on you holding the bag.
Linux has maintained backwards compat for decades, there really isn't much excuse.
In what way? IIRC there is no stable ABI in Linux.
Regardless maintaining backward compatibility forever is non-trivial. Besides Java I can't think of another major platform still actively supporting their v1.0 work.