Subject: Re: bug#74604: 30.0.92; FR: M-x package-upgrade - offer an option to show a diff on upgrade

From: Daniel Mendler <[email-masked]>
Date: Mon, 02 Dec 2024 00:12:15 +0100

Philip Kaludercic <[email-masked]> writes:

> Daniel Mendler <[email-masked]> writes:
>
>> This is a feature request for the security wishlist. When upgrading
>> package it would be good to show a diff between the new and old package
>> files. Such an option could help performing review casually as part of
>> the upgrade process and may improve the security of the package
>> archives. More eyes would look at new package versions. This would make
>> it harder to inject malicious code either via the source repository or
>> via attacks on the package archives.
>
> That sounds like a good option to have!  I'll look into adding something
> like this via a user option that adjusts how to confirm a package upgrade.

Thanks! I am happy to test if you have a patch ready.

Daniel