Inquiry: Contributing to 8.60.0 Release - Missing Base Branch for PR

[goyalk130]

I'm looking to contribute a fix/enhancement to the 8.60.0 release of Stream Chat.

My changes are based around the state of the repository at commit 7bacecb (which I believe is part of the 8.60.0 release lineage).

However, when preparing to open a Pull Request, I noticed that branches typically associated with older releases, such as release/8.60 or 8.60, appear to be deleted or are not readily visible in the repository. The master (or main) branch is currently at version 9.11, which is significantly ahead of 8.60.0.

Could you please advise on the correct workflow or designated branch for submitting contributions specifically targeting the 8.60.0 release? I want to ensure my contribution aligns with your project's maintenance strategy for older versions.

I'm happy to adapt my contribution to your preferred method (e.g., creating a new branch based on a specific tag, or another approach).

[oliverlaz]

hi @goyalk130, you can create a new branch from the release tag that we always push in the repo.
May I ask what kind of improvements you want to push to our v8 release line?
Why not contribute them to v9, and in the meantime upgrade to it? The migration process should be quite straightforward.

[goyalk130]

The improvement I'm pushing is a critical security fix for the form-data vulnerability (CVE-2025-7783 / GHSA-fjxv-7rqg-78g4). stream-chat@8.58.0 (and 8.60.0) has a transitive dependency on form-data@4.0.0, which is affected.

This fix is important for our current production environment still on v8. My PR will aim to update form-data to 4.0.4.

[MartinCupela]

hey @goyalk130, I will take a look into this

[MartinCupela]

@goyalk130 is there something preventing you from upgrading the dependency on your side? Have you considered using resolutions field in case you are using yarn or overrides for npm or pnpm.overrides in case of pnpm?

[goyalk130]

Hi @MartinCupela

Thank you for taking a look and for already opening #1591 to address the form-data vulnerability – that's a huge help.

To answer your question: yes, we have implemented overrides in our package.json to temporarily force form-data@4.0.4 on our side. Your PR will provide a more robust and official fix directly within stream-chat.

[goyalk130]

Would it be possible to cut a new patch release for the v8 line (e.g., 8.60.1 or 8.61.0)? As this is a critical security fix, an official release would be incredibly beneficial for projects like ours that are still on v8.

@MartinCupela

[goyalk130]

@oliverlaz @MartinCupela can anyone from you make a release ?