4 ms·

My guess would be he/she did not lock the versions in package.json, but used "wildcards" (I consider `1.x` a wildcard.) Happened to me once, took about a day to

My guess would be he/she did not lock the versions in package.json, but used "wildcards" (I consider `1.x` a wildcard.) Happened to me once, took about a day to figure out. I really dig `Gemfile.lock` in Ruby land for this purpose.

joshmanders 10y ago
So I was correct in saying they did something wrong. :) npm follows semver and expects libraries to do the same, whether they do or not is up to the library author, but npm can't know if the library does or not. Therefor the user didn't pay attention to the library they are using and blindly installed it and set constraints that caused breaking changes to get into their code. Once again, not the ecosystems fault, but the developers fault.
- kmudrick 10y ago
  Semver is wonderful... If every dependency in your dependency tree follows semver perfectly. But the reality is that while you may lock your immediate dependencies down, you are still at the mercy of what is probably a pretty deep tree of transitive dependencies, of which you have very little control over. Unless you resort to things like shrinkwrap in the npm world. Which kinda feels like a gigantic hack to me.
- borplk 10y ago
  No you were not, what I was referring to had nothing to do with locking down version numbers. I said "fragile". That doesn't mean something wasn't objectively "my fault". Yes the bytes don't change themselves, I was the one making some changes here and there so in that sense it's my fault. But that's a very mechanical and shallow way to think about it. Javascript as a language and ecosystem makes it extremely easy to create mistakes. In that sense a mistake that I make is partially Javascript's fault too. Some people look at what I said and think "programming languages need to be better" and some think "humans need to be better". The people in the second group don't help moving things forward. They just blame people for not being "smart enough" until the people in the first group set a new standard for what things should look like.

joshmanders 10y ago

So I was correct in saying they did something wrong. :) npm follows semver and expects libraries to do the same, whether they do or not is up to the library author, but npm can't know if the library does or not. Therefor the user didn't pay attention to the library they are using and blindly installed it and set constraints that caused breaking changes to get into their code. Once again, not the ecosystems fault, but the developers fault.

kmudrick 10y ago
Semver is wonderful... If every dependency in your dependency tree follows semver perfectly. But the reality is that while you may lock your immediate dependencies down, you are still at the mercy of what is probably a pretty deep tree of transitive dependencies, of which you have very little control over. Unless you resort to things like shrinkwrap in the npm world. Which kinda feels like a gigantic hack to me.
borplk 10y ago
No you were not, what I was referring to had nothing to do with locking down version numbers. I said "fragile". That doesn't mean something wasn't objectively "my fault". Yes the bytes don't change themselves, I was the one making some changes here and there so in that sense it's my fault. But that's a very mechanical and shallow way to think about it. Javascript as a language and ecosystem makes it extremely easy to create mistakes. In that sense a mistake that I make is partially Javascript's fault too. Some people look at what I said and think "programming languages need to be better" and some think "humans need to be better". The people in the second group don't help moving things forward. They just blame people for not being "smart enough" until the people in the first group set a new standard for what things should look like.