> Mima is probably the most advanced binary compatibility checker anywhere. Not everyone's using it, but projects that do can provide very good guarantees.
Certainly, but that's not what I was talking about is it?
My point was that there isn't a culture (in the JVM world) of just publishing the source. If there was there would be no problems other than source-incompatibility. The culture in Haskell-land is that either a) you publish the sources or b) you deal with whatever pain may come your way.
Mostly, people have followed approach a) when it comes to things like "parse JSON fast/reliably" (aeson), but b) when it comes to "oh, this is our trading platform/strategy". Which is fine... but the ecosystem usually benefits from the a) side of things.
(Shout out to Bryan o'Sullivan.)
Given that many dependencies are Java and there's no agreement on build tooling, it'd be hard to build all dependencies from source (I actually had a client look seriously into doing this). I mean given a maven project, the pom is included in the release and contains all the information (e.g. SCM tag) necessary to rebuild it. But not everyone's using maven.