4 ms·
We don't need lockfiles in Java land because we generally use version ranges very carefully and rely on package developers following semver - and we certainly d
by EdwardDiego 8y ago
We don't need lockfiles in Java land because we generally use version ranges very carefully and rely on package developers following semver - and we certainly don't use "just whatever the latest release is, dude" like shown in the example Pipfile: https://pipenv.readthedocs.io/en/latest/basics/#example-pipfile-pipfile-lock https://pipenv.readthedocs.io/en/latest/basics/#example-pipf... (the asterisks)
I get why Python needs lockfiles, but goddamn, that need is a symptom of the mess of managing Python dependencies.
There's still a long way to go - I use Airflow for ETL management, and I'm using pipenv to manage it - except Pipenv can't create a lockfile because a dependency of a dependency of Airflow requires in flask-wtf <= 0.7, while another dependency of a dependency requires ==0.8
In a Maven pom.xml I can easily exclude or override the conflicting dependency manually if needed, but I can't in a Pipfile.
- icebraining 8y agorely on package developers following semver Well, that seems naive. Almost 1/4th of Maven Central libraries broke binary compatibility in patch updates: https://avandeursen.com/2014/10/09/semantic-versioning-in-maven-central-breaking-changes/ https://avandeursen.com/2014/10/09/semantic-versioning-in-ma... Netflix, at least, doesn't agree that Java doesn't need lockfiles: https://github.com/nebula-plugins/gradle-dependency-lock-plugin https://github.com/nebula-plugins/gradle-dependency-lock-plu...
- ben-schaaf 8y agoWith my very small sample size, maven and gradle's lack of version locking just means it gets tacked on in terrible ways when needed.
- ric2b 8y ago> We don't need lockfiles in Java land because we generally use version ranges very carefully Yes, which is part of the reason why lots of Java projects almost never update their dependencies, because no one remembers why that version was chosen. Splitting what you want from what you have is important to communicate this. > There's still a long way to go - I use Airflow for ETL management, and I'm using pipenv to manage it - except Pipenv can't create a lockfile because a dependency of a dependency of Airflow requires in flask-wtf <= 0.7, while another dependency of a dependency requires ==0.8 I'm not sure what you expect it would be able to do here...
- EdwardDiego 8y agoEnforce Flask-wtf 0.8 and see if it works.