News for hackers. Stuff that matters.

A comment on We shouldn't have needed lockfiles. Parent comment

Re:We shouldn't have needed lockfiles by yawaramin on Wednesday August 06, 2025 @05:14PM (#44817943)
The data is also centralized without lockfiles though...it's in the package spec file itself, where all version can be upgraded together. If you are saying the only difference is some tooling for automation, that's a temporary problem, not a fundamental one.
[ Parent | on HN ]
Re:We shouldn't have needed lockfiles by chowells on Wednesday August 06, 2025 @06:39PM (#44818682)
By "centralized" I mean a single file that contains all transitive dependency version information and nothing else. This is very different than having to recursively examine tiny portions of your dependencies' package specs recursively to find all transitive dependencies.
[ Parent | on HN ]
Re:We shouldn't have needed lockfiles by growse on Wednesday August 06, 2025 @06:00PM (#44818356)
Without a lock file your transitive dependencies are.... by definition not centralised?

Or have I misunderstood?

[ Parent | on HN ]