Any guideline about severity of bugs?

[Dukc]

On Monday, 18 July 2022 at 14:44:53 UTC, RazvanN wrote:
> Enhancement - I use this tag for bug reports that propose a new 
> feature or a new extension for an existing feature. So if 
> something is proposed but is not covered by the spec, I tag 
> that as an enhancement.
>
> Trivial - I use this tag for bug reports where I can evaluate 
> that the fix is indeed trivial; for example: a typo in an error 
> message, request for fully qualified name for a symbol in an 
> error message, adding documentation etc.
>
> Minor - I haven't used this tag ever and I would advocate for 
> removing it. In theory, this tag should be used for bug reports 
> where the behavior is wrong, but but the outcome is something 
> that you can live with. Typically, when the compiler issues an 
> error message that is not quite indicative of the problem you 
> could tag that error as being minor. :-?
>
> Normal - this is how most of the bugs should be tagged.
>
> Major - this is used for bugs that affect a lot of code but for 
> which there exists a work around. Typically, I use the major 
> tag for bugs that are reported by industry players.
>
> Critical - ICEs
>
> Blocker - Major issues that have no workarounds
>
> Regression - speaks for itself.
>
> As for when fixing bugs, indeed I look at regressions first and 
> then at criticals and blockers.
>
> Hope this helps,
> RazvanN

Thanks, these are good starting points in my opinion. I also 
propose some extra conventions:

  - The regression category is literally for regressions only. The 
blocker category, however, is a generic severity category, 
meaning it's for the most serious non-regression bugs of any 
type. Not just for literal blockers.

  - accepts-invalid or rejects-valid should usually be normal or 
higher. Trivial and minor categories are mainly for minor 
documentation and error message shortcomings.

  - Unsafe code being accepted in `@safe` should be major or 
higher.

  - Compiled code behaving wrong in a way that's likely to go 
undetected (thinking wrong optimisations) is critical or blocker.

  - A security vulnerability (if reported publicly at all) should 
always be a blocker, if it's not a regression.