3 ms·
The problem is that nobody really tests all the versions they specify in a dependency list. They just install the dependencies, and if everything works, commit
by codedokode 9y ago
The problem is that nobody really tests all the versions they specify in a dependency list. They just install the dependencies, and if everything works, commit the file.
In PHP we usually have a version range in libraries' dependencies and lock file that specifies exact dependency versions for the entire application. So you can be sure that you get tested combinantion of libraries.
- bmn__ 9y agoI'm pretty sure lockfiles get ignored by PHP packagers as a practical matter.
- mattacular 9y agoCan you elaborate on what you mean? Composer is the most popular PHP packager and its two core commands - update and install - make updates to and install from the composer.lock file respectively
- eeZah7Ux 9y ago> The problem is that nobody really tests all the versions they specify in a dependency list Some do. Some others target the versions shipped in a stable Linux distribution. And even if the upstream don't test some combinations of versions, distributions will test what they ship.
- codedokode 9y ago> Some do. How can they check future versions of libraries that will match the range?