4 ms·

Why why why is the default behavior of npm install to choose a range of versions rather than a single version. I don’t want “a version compatible with lib 0.1.

by habosa 6y ago

Why why why is the default behavior of npm install to choose a range of versions rather than a single version. I don’t want “a version compatible with lib 0.1.0” I want lib 0.1.0 ... package-lock is a strange bandaid over this. If I want the code my app depends on to change, I’ll change it.

joshstrange 6y ago
I turn that off whenever I setup a new computer. I too want my packages to be exact. It has only ever caused me pain. Mainly around a package author introducing a breaking change in a minor/patch version (which I actually don't fault them for). I see ranges as "wobbly" foundation and the more dependancies on dependancies you have the "wobblier" your foundation becomes. I've spent hours tracking down some mid-depth dep that was being installed with a range that had deps that had a range that had deps that had a range and because of this a new "npm install" or update causes a massive jump in version of some very low-level library that DOES have a breaking change that propagates up. It's all a house of cards. Any package manager I use for software development I lock down versions as tight as I can. If I have a problem I'll go read the change log, commit log, release notes, etc for the library in question to see if they have a fix for the issue I am having but blindly hoping everyone follows SEMVAR to the letter and doesn't just miss something they didn't test for is laughable.
rodw 6y ago
> I don’t want “a version compatible with lib 0.1.0” I want lib 0.1.0 ... package-lock is a strange bandaid over this. Doesn't plain semver in your package.json dependencies already give you this capability? ``` { "dependencies": { "foo" : "2.0.1" } } ``` Should yield version 2.0.1 _exactly_. It's the use of modifiers like ~ and ^ that yield the fuzzy matching. https://docs.npmjs.com/files/package.json#dependencies https://docs.npmjs.com/files/package.json#dependencies
marcus_holmes 6y ago
why bother with the package system at all then? Why not just copy/paste the code into your project?
- habosa 6y ago
  Npm provides much more value than copy-pasting code! I think we all know that. That said if I happen upon a possible dependency that's just one JS file and has a permissive license, I often do choose the copy-paste route.

by habosa 6y ago

joshstrange 6y ago

I turn that off whenever I setup a new computer. I too want my packages to be exact. It has only ever caused me pain. Mainly around a package author introducing a breaking change in a minor/patch version (which I actually don't fault them for). I see ranges as "wobbly" foundation and the more dependancies on dependancies you have the "wobblier" your foundation becomes. I've spent hours tracking down some mid-depth dep that was being installed with a range that had deps that had a range that had deps that had a range and because of this a new "npm install" or update causes a massive jump in version of some very low-level library that DOES have a breaking change that propagates up. It's all a house of cards. Any package manager I use for software development I lock down versions as tight as I can. If I have a problem I'll go read the change log, commit log, release notes, etc for the library in question to see if they have a fix for the issue I am having but blindly hoping everyone follows SEMVAR to the letter and doesn't just miss something they didn't test for is laughable.

rodw 6y ago

> I don’t want “a version compatible with lib 0.1.0” I want lib 0.1.0 ... package-lock is a strange bandaid over this. Doesn't plain semver in your package.json dependencies already give you this capability? ``` { "dependencies": { "foo" : "2.0.1" } } ``` Should yield version 2.0.1 _exactly_. It's the use of modifiers like ~ and ^ that yield the fuzzy matching. https://docs.npmjs.com/files/package.json#dependencies https://docs.npmjs.com/files/package.json#dependencies

marcus_holmes 6y ago

why bother with the package system at all then? Why not just copy/paste the code into your project?

habosa 6y ago
Npm provides much more value than copy-pasting code! I think we all know that. That said if I happen upon a possible dependency that's just one JS file and has a permissive license, I often do choose the copy-paste route.