Re:We shouldn't have needed lockfiles
by chowells on Wednesday August 06, 2025 @04:53PM
(#44817709)
The difference is that the data is centralized with a single source of truth, and you have tools for working with it automatically. It doesn't mean lockfiles are cheap to update, but it does mean it's a much more streamlined process when it's time.
[ Parent
| on HN ]
Re:We shouldn't have needed lockfiles
by yawaramin on Wednesday August 06, 2025 @05:14PM
(#44817943)
The data is also centralized without lockfiles though...it's in the package spec file itself, where all version can be upgraded together. If you are saying the only difference is some tooling for automation, that's a temporary problem, not a fundamental one.
By "centralized" I mean a single file that contains all transitive dependency version information and nothing else. This is very different than having to recursively examine tiny portions of your dependencies' package specs recursively to find all transitive dependencies.