3 ms·
A key difference with Maven projects is that you specify exact dependency versions instead of “always use latest” or some variant of that, as is pretty common i
by xienze 5y ago
A key difference with Maven projects is that you specify exact dependency versions instead of “always use latest” or some variant of that, as is pretty common in the Node world.
- sverhagen 5y agoThis is not necessarily true, there are version ranges: https://www.baeldung.com/maven-dependency-latest-version https://www.baeldung.com/maven-dependency-latest-version Admittedly, I don't think it has nearly as wide a usage as it has in the NPM world. Dependabot (I know I'm not the first to mention it, here, today) is probably more of a factor. Still, it strikes me that this sort of "attack" (or mishap) is exceedingly rare in the Java ecosystem, while it's pretty common in the NPM world, and I don't immediately understand why that would be so.
- bombcar 5y agoWe abuse jitpack.io and MASTER-snapshot to keep out Minecraft maven builds up to date.
- xienze 5y agoI was not aware of that feature. To call it rare would be an understatement I think. > while it's pretty common in the NPM world, and I don't immediately understand why that would be so. I think it boils down to Node projects typically specifying dependencies in the form “any version >= X”, effectively “always use the latest.” Dependencies can therefore get bumped silently just by rebuilding, essentially. Whereas in the Java world updating dependencies is a deliberate process.
- dvdcxn 5y agoWith lock files, you will always be stuck with whatever version you first installed until you explicitly ask npm to upgrade, or delete your lockfile.