4 ms·
IMO, Ruby Bundler was the first language / ecosystem to really get dependencies right. AFAIK, they were the first to have a lockfile locking the version of each
by ufmace 5y ago
IMO, Ruby Bundler was the first language / ecosystem to really get dependencies right. AFAIK, they were the first to have a lockfile locking the version of each dependency and a Gemfile with flexible version specification for dependencies, and a tool to handle installing the right version of everything and making sure you run in the context of your specified gems every time, no matter what else is installed on the machine.
Rust Cargo does about as well, probably the best for a compiled language. NPM could be about as good too - it almost feels like they deserve a point off for the ridiculously huge number of tiny packages required to do anything, though that isn't really the dependency manager's fault.
- pjmlp 5y agoCPAN and Maven did it first.
- morelisp 5y agoMaven doesn't have a lockfile, from just reading the files it's difficult to find the version of a dependency you'll actually get.
- pjmlp 5y agoIt doesn't need one, when version is already part of dependency definition. If you want to be sure of what version you get, use it.
- morelisp 5y agoTransitive dependencies are not going to be in your POM file normally, and Maven has a confusing algorithm for resolving them (essentially, first found in a BFS over the dependency tree). And if you do include them, that will silently override transitive dependencies on more recent versions, which is rarely what is wanted. Yes, you can ask the tool to print them. This is way worse than any of the other systems being discussed, where you can read a file in the repo.
- pjmlp 5y agoIt is so hard to redirect the tool output to my-favourite-filename.lock, beyond the skills of the average developer.
- hawski 5y agoOne may like it or not, but defaults matter.
- pjmlp 5y agoDefaults don't change history.
- morelisp 5y agoNaming the file .lock does not make it a lockfile. (I can't believe I have to write that sentence. I don't think you're discussing technical details in good faith.)
- pjmlp 5y agoOf course not, it fixes "... where you can read a file in the repo", because Maven already does everything else anyway.
- morelisp 5y ago> Ruby Bundler was the first language / ecosystem to really get dependencies right. AFAIK, they were the first to have a lockfile locking the version of each dependency and a Gemfile with flexible version specification for dependencies, So other than having a lockfile and having a flexible version specification (and a sensible way to resolve multiple version requests), Maven did "it" first! ... what was "it" again?
- pjmlp 5y agoEverything.