News for hackers. Stuff that matters.
Re:We shouldn't have needed lockfiles by hyperpape on Wednesday August 06, 2025 @05:45PM (#44818226)
I think the difference is that since libraries do not specify version ranges, you must manually override their choices to find a compatible set of dependencies.

The solution is version ranges, but this then necessitates lockfiles, to avoid the problem of uncontrolled upgrades.

That said, there's an option that uses version ranges, and avoids nondeterminism without lockfiles: https://matklad.github.io/2024/12/24/minimal-version-selecti....

Note: maven technically allows version ranges, but they're rarely used.

There are no comments on this comment yet.