3 ms·
pinning dependencies to a specific version does not seem to be a workable and practical advice, if everyone locked every single dependency wouldn't most 3rd pa
by glofish 5y ago
pinning dependencies to a specific version does not seem to be a workable and practical advice,
if everyone locked every single dependency wouldn't most 3rd party software be uninstallable?
for any moderately complex software conflicts will arise if they share dependencies.
- verdverm 5y agoGo modules does this, but uses a different algorithm and semantics. I really think they have done a great job w.r.t. software supply chain security. I've been working on a post here going into detail https://verdverm.com/go-mods/ https://verdverm.com/go-mods/