News for hackers. Stuff that matters.

A comment on The vgo proposal is accepted. Now what?. Parent comment

Re:The vgo proposal is accepted. Now what? by sseth on Wednesday May 30, 2018 @07:27AM (#17186775)
Most package managers ignore the lock files of the dependencies when picking up versions - they only use the lockfile of the topmost project for picking up versions.

The big difference with the MVS strategy in vgo is that the dependency list of a dependency is actually used to determine the version. If package A uses B, which was tested with v1.2 of package C, you will get v1.2 of C, even if there is a later version of C available.

In the typical package manager scenario, the dependency list of B may be pointing to an old version of C which does not even work with B - there is generally no way to ask : give me the latest version of C which was tested with B.

[ Parent | on HN ]
Re:The vgo proposal is accepted. Now what? by eridius on Wednesday May 30, 2018 @01:46PM (#17189840)
I think package managers should have an option to run a build of your package using the oldest versions instead of newest versions, just to validate that the build works, but that this shouldn't be the normal way to resolve dependencies.
[ Parent | on HN ]