4 ms·
Getting security fixes automatically is not a good thing. Too many open source projects fail to ensure non-breaking changes or long term support of multiple re
by marichards 9y ago
Getting security fixes automatically is not a good thing.
Too many open source projects fail to ensure non-breaking changes or long term support of multiple release versions.
So either you rely on greatest(>) that has no guarantees to not break and not just patches (~), you try patches and a new release is effectively end of support or you rely on greatest, fail to do a regular audit and realise the dependency is no longer in active development and will receive any updates (which upon typical discovery would require a change of dependency used).
Security isn't just about vulnerability, and I don't like to ask it (because it isn't universal), but is not a risk of system failure often worse than a risk of system vulnerability? It depends somewhat on how critical the system is and defaulting to explicit versions instead of latest is probably a better practice in my opinion.
I've done development using NodeJs and on the JVM and found I had far fewer problems with Java dependency management.
- senko 9y ago> Too many open source projects fail to ensure non-breaking changes or long term support of multiple release versions. Relying on those projects is not a good thing.
- digi_owl 9y agoWhen such big names as Gnome can't pull it off, then what projects can one rely on?
- zer0tonin 9y agoFor example React doesn't ever introduce breaking change by surprise.
- lucisferre 9y agoI think that should be qualified with "intentionally". Angular is supposed to be following semver but often has "regressions" in point releases which they fix in a following point release. Usually fairly quickly but it is still not guaranteed.
- filmor 9y agoPoint releases of Gnome libraries introduce breaking changes?
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- steveklabnik 9y ago> Getting security fixes automatically is not a good thing. Automatically when you request an upgrade to your dependencies. Older npm's defaults were terrible here, but as of npm5, it works more like Bundler/Cargo. You get deterministic installation, and "bundle update" lets you get a tool-assisted upgrade.