3 ms·
If package A depends on package C at version 1.0 but package B depends on C at version 1.1, what version of C will be pulled in? Dependency management is not a
by codebje 5y ago
If package A depends on package C at version 1.0 but package B depends on C at version 1.1, what version of C will be pulled in?
Dependency management is not as simple as only upgrading one direct dependency at a time after careful review.
The NPM ecosystem is particularly difficult to work with as it has deep and broad transitive dependency trees, many small packages, and a very high rate of change.
You either freeze everything and hope you don't have an unpatched vulnerability somewhere or update everything and hope you don't introduce a vulnerability somewhere.
- oblio 5y agoThere are package exclusions, package forcing and of course, full dependency tree checks where you review what everything pulls in. The JS ecosystem will probably have to change but because it's so decentralized, that change will be orders of magnitude harder than, for example, PHPs transition from 3 (4, 5) to 7.
- throw_m239339 5y ago> The JS ecosystem will probably have to change but because it's so decentralized, Is it? Everybody is pulling from Microsoft owned servers now, as Microsoft owns both Github and NPM.
- oblio 5y agoYou're right in the package storage sense. I don't think you're right in the builder/building practices sense.
- throw_m239339 5y ago> Dependency management is not as simple as only upgrading one direct dependency at a time after careful review. Most package managers won't allow these stunts and conflicts have to be resolved UPSTREAM. NPM chose to go the "YOLO" way and will fetch every single version of a package that meets the dependency demands. Terrible design, but the purpose of that was growth for NPM, the company, not the best interest of the ecosystem.