News for hackers. Stuff that matters.
Re:Uv's killer feature is pulling in local dependencies by zo1 on Sunday January 12, 2025 @04:46PM (#42677260)
The requirements.txt file is the lockfile. Anyways, this whole obsession with locked deps or "lockfiles" is such an anti-pattern, I have no idea why we went there as an industry. Probably as a result of some of the newer stuff that is classified as "hipster-tech" such as docker and javascript.
Re:Uv's killer feature is pulling in local dependencies by n144q on Sunday January 12, 2025 @05:13PM (#42677497)
Just because you don't understand it, it's ok to call it an "anti-pattern"?

Reproducibility is important in many contexts, especially CI, which is why in Node.js world you literally do "npm ci" that installs exact versions for you.

If you haven't found it necessary, it's because you haven't run into situations where not doing this causes trouble, like a lot of trouble.

Re:Uv's killer feature is pulling in local dependencies by driggs on Sunday January 12, 2025 @05:34PM (#42677660)
Just because someone has a different perspective than you doesn't mean they don't "understand".

Lockfiles are an anti-pattern if you're developing a library rather than an application, because you can't push your transitive requirements onto the users of your library.

Re:Uv's killer feature is pulling in local dependencies by Uvix on Sunday January 12, 2025 @05:56PM (#42677854)
If you're developing a library, and you have a requirement for what's normally a transitive dependency, it should be specified as a top-level dependency.
Re:Uv's killer feature is pulling in local dependencies by driggs on Sunday January 12, 2025 @06:37PM (#42678246)
The point is that if I'm writing a library and I specify `requests == 1.2.3`, then what are you going to do in your application if you need both my library and `requests == 1.2.4`?

This is why libraries should not use lockfiles, they should be written to safely use as wide a range of dependencies' versions as possible.

It's the developers of an application who should use a lockfile to lock transitive dependencies.

Re:Uv's killer feature is pulling in local dependencies by phinnaeus on Sunday January 12, 2025 @08:58PM (#42679224)
The lock file is for developers of the library, not consumers. Consumers just use the library’s dependency specification and then resolve their own dependency closure and then generate a lock file for that. If you, as a library developer, want to test against multiple versions of your dependencies, there are other tools for that. It doesn’t make lock files a bad idea in general.
Re:Uv's killer feature is pulling in local dependencies by zahlman on Monday January 13, 2025 @01:16AM (#42680599)
As another library developer, of course I want to test against multiple versions. Or more accurately, I don't want to prevent my users from using different versions prematurely. My default expectation is that my code will work with a wide range of those versions, and if it doesn't I'll know - because I like to pay attention to other libraries' deprecations, just as I'd hope for my users to pay attention to mine.

Lockfiles aren't helpful to me here because the entire point is not to be dependent upon specific versions. I actively want to go through the cycle of updating my development environment on a whim, finding that everything breaks, doing the research etc. - because that's how I find out what my version requirements actually are, so that I can properly record them in my own project metadata. And if it turns out that my requirements are narrow, that's a cue to rethink how I use the dependency, so that I can broaden them.

If I had a working environment and didn't want to risk breaking it right at the moment, I could just not upgrade it.

If my requirements were complex enough to motivate explicitly testing against a matrix of dependency versions, using one of those "other tools", I'd do that instead. But neither way do I see any real gain, as a library developer, from a lock file.

Re:Uv's killer feature is pulling in local dependencies by imtringued on Monday January 13, 2025 @02:28AM (#42680968)
>If I had a working environment and didn't want to risk breaking it right at the moment, I could just not upgrade it.

The point of a lockfile is to only upgrade when you want to upgrade. I hope you understand that.

Re:Uv's killer feature is pulling in local dependencies by zahlman on Monday January 13, 2025 @04:20AM (#42681577)
Why do I need a special file in order to not do something?
Re:Uv's killer feature is pulling in local dependencies by orf on Sunday January 12, 2025 @07:02PM (#42678407)
That’s not the perspective that OP was sharing, though.
Re:Uv's killer feature is pulling in local dependencies by remram on Sunday January 12, 2025 @07:42PM (#42678684)
You literally phrased it as "I have no idea why". You can't be upset if someone feels you don't understand.
Re:Uv's killer feature is pulling in local dependencies by Pannoniae on Sunday January 12, 2025 @09:20PM (#42679356)
"I have no idea why" the industry went there. One can understand a technology or a design pattern yet think it's completely idiotic. (low-hanging fruit: JavaScript, containers, etc.)
Re:Uv's killer feature is pulling in local dependencies by wiseowise on Sunday January 12, 2025 @05:58PM (#42677868)
I’m pretty sure it was a sarcasm.