3 ms·

This question merits a detailed answer that I can't provide right now, but here are some pointers: https://hypirion.com/musings/lockfiles-are-not-the-only-opti

This question merits a detailed answer that I can't provide right now, but here are some pointers: https://hypirion.com/musings/lockfiles-are-not-the-only-option https://hypirion.com/musings/lockfiles-are-not-the-only-opti... https://stackoverflow.com/questions/44521542/why-doesnt-gradle-or-maven-have-a-dependency-version-lock-file https://stackoverflow.com/questions/44521542/why-doesnt-grad...

regularfry 6y ago
All those links really tell me is that the problem lockfiles solve has been arbitrarily ignored. "A solution can exist, it's just not currently implemented" seems to be the state of things, unless I've misread it. I'm all up for saying "thou shalt specify precise versions of library dependencies", but the specific case of `org.clojure/clojure` seems qualitatively different in that a precise version influences your consumers, and leaving it unspecified means your library might not work at all.