3 ms·
This seems to me, to be a package manner implementation detail. The packager manager I am most familiar with, npm, won't have an issue with the diamond problem,
by JMTQp8lwXL 7y ago
This seems to me, to be a package manner implementation detail. The packager manager I am most familiar with, npm, won't have an issue with the diamond problem, since node modules can install nested modules, allowing B and C to both depend on unique versions of D.
- EsssM7QVMehFPAs 7y agoEffectively rendering B and C incompatible in sharing D objects and structures. Just because you technically can doesn't make it a good thing in software architecture. There is a reason why most globally linked runtimes (e.g. C++ or Java) do not encourage such mechanisms.
- blablabla123 7y agoIn times of security fixes sometimes there is only one secure version but the whole ecosystem is built around the fact that older, flawed version can still be included. Another drawback is performance, npm install is amazingly slow. In fact package resolution is NP-complete: https://research.swtch.com/version-sat https://research.swtch.com/version-sat I generally agree but the problem is even worse :)
- JMTQp8lwXL 7y agoYarn is a bit more sophisticated and has a concept of "resolutions" which would be great for the security use case of forcing a particular version. Even if B and C need different major versions, say D@v1-with-security-fix and D@v2-with-security fix, yarn supports that too, since resolutions can be nested. https://yarnpkg.com/lang/en/docs/selective-version-resolutions/ https://yarnpkg.com/lang/en/docs/selective-version-resolutio...
- jayd16 7y agoWhat happens when B and C need to pass each other an object from D that's been changed?