4 ms·

I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency. How tf is this fine? They don't

I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency. How tf is this fine? They don't even offer alternative. They just say "we can't test all of the packages installed and all version combinations, so this is the best we can do". Well, no one asked you to test my exact setup. All I'm asking for is: if I have perfectly working Node 18 and I need to install fcking Shopify CLI, don't fcking install Node 19 and break my whole setup! Tf?!

deleted 4y ago
[deleted]
BillinghamJ 4y ago
You could always manage your packages and their dependencies yourself. Or you could release a new package manager which does provide support for that functionality, build out a team of maintainers, and stay on top of all the releases
- gizmo 4y ago
  That's like saying "if you don't like your country, start your own". The goal isn't to abandon homebrew, but to have it not break things all the time.
  - notpushkin 4y ago
    It's really not. It's borderline impossible (pun intended) to start your own country, mainly because you need to find a piece of land first. Starting a package manager is, like, a few months of work?
- tacker2000 4y ago
  Thats such a cop out answer! So according to you nobody is allowed to criticise anything because “shut up and build it yourself if you dont like it”?
hnlmorg 4y ago
You can specify specific package versions in brew if you want specific versions pinned. The default behaviour of using the latest in repo is correct and is how every package manager works. It’s the behaviour people expect and it’s the behaviour that is arguably more secure (the fact that homebrew is bleeding edge does create issues here but generally speaking my point stands). I believe you pin using the @ symbol followed by a version number. Eg brew install awesome-project@13.0
- gizmo 4y ago
  This is not at all how every package manager works. On debian if you install a package it will just install that package and it will warn you if dependencies will require upgrading first. It won't upgrade totally unrelated packages and break everything for you. In addition, you have different branches where the debian stable branch is extremely well tested. Homebrew is way, way worse than any other package manager because it just breaks stuff all the time.
  - jeroenhd 4y ago
    But the shopify cli, the given example, does depend on nodejs. If you tell Debian's apt to install a package that depends on a newer version of an installed package, it'll update that package for you as well. If Debian stable updates their nodejs package to 19 and you install any package that depends on nodejs, expect to get the nodejs 19 update. The difference here is that Debian pins versions of software per release so you won't run into these situations. That's fine if you're willing to deal with running older software maintained by Debian rather than the original developers, but that's just a choice. From what I can tell, Homebrew acts more like pacman and friends; it expects you to stay up to date, and if you don't it's up to you to fix the problem.
  - acdha 4y ago
    > On debian if you install a package it will just install that package and it will warn you if dependencies will require upgrading first. It won't upgrade totally unrelated packages and break everything for you This is exactly how Homebrew works, too. The difference is that Debian won’t ship a new version outside of a major release so if you started with Node 18 you won’t get 19 until next year. Now, of course, developers usually don’t like that so there are non-core repositories which update more frequently … and you get exactly the behavior which Homebrew has. Being oriented at developers just means Homebrew does that by default.
stephenr 4y ago
Homebrew’s dependency resolution was a complete joke the last time I checked it out, but they were completely happy with the laughable results so I won’t be surprised if it hasn’t changed. Essentially it did all dependency resolution at build time (because brew used to have no prebuilt binaries and everyone’s workstation would spend 90 minutes compiling the same things over and over again). But when they added binary distribution they didn’t change the dependency resolution to work like eg deb’s or rpm’s do. It used to be that if you told it to install from source it would thus be able to “detect” your local existing package that provides the dependency. It may just take a while depending on what you’re installing.
callahad 4y ago
I've been using Nix (and, occasionally, MacPorts) instead of Homebrew for a few years now. Works great, and doesn't have that particular issue. If Nix seems like a bridge too far, the Devenv project offers some nice, lightweight porcelain atop the raw Nix experience.
- e12e 4y ago
  Does nix have pre-built binaries for m1/m2/arm macs? I'm not enjoying having to rebuild clang and gcc as build-deps with macports... :/
  - callahad 4y ago
    Yep!
Upvoter33 4y ago
learn to use the free software you are complaining about, that's a first step.
pornel 4y ago
That's a Node problem. They make semver-major breaks on a regular schedule, which is a flabbergasting policy. Besides, you're still in trouble even if you don't upgrade, because then your JS deps will eventually start breaking from a too-old Node. And if you don't upgrade deps, you risk vulnerabilities, and you won't know which one of the 20 "critical" npm reports are ReDoS spam, and which one are actually important.
tiagod 4y ago
I use asdf for tooling I need to keep several versions of. People have also mentioned Nix, but I haven't tried it out yet.
- Nihilartikel 4y ago
  I wanted to love Nix, and still use it sometimes, but it is unfortunately not very friendly to arbitrary package version selection. Asdf for the worse-is-better win!
thiht 4y ago
> I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency I love it. I'm using a desktop, not a server. I specifically want my dependencies to be always up to date > All I'm asking for is: if I have perfectly working Node 18 and I need to install fcking Shopify CLI, don't fcking install Node 19 and break my whole setup! Tf?! Then install nvm. Nvm will always be latest, the Homebrew packages will always depend on the latest node version, and locally you'll depend on your own node version that you installed with nvm.
vvillena 4y ago
You didn't install "Node 18", you installed "Node". If you want Node 18, grab the "node@18" package instead of "node". This is how Brew has managed this problem for years: problematic dependencies that need to be pinned to specific versions are given specific packages.
- silverwind 4y ago
  Why can't it allow pinning of all packages like any sane package manager would?
  - vvillena 4y ago
    It can: "brew pin <package>"
yamtaddle 4y ago
If you have project dependencies, Homebrew's not a good fit for that—but, crucially, that's far from just being a problem with Homebrew, it's true of most (not all, but most) system package managers. Using a tool-specific system (e.g. nvm), or Docker, or a VM, is far better for reproducibility. Homebrew's better for installing things you're going to use directly, yourself. Like, don't use it to install Postgres system-wide if you need it for some rails "app"—you'll just run into pain the first time you have to git-bisect or go back and fix some older deployed branch and that version was running on some earlier version of Postgres, or the first time you want to work on a second project that relies on a different version. That's not just a Homebrew thing, the same problem applies, to, say, Debian and dpkg—don't use those to install project deps, unless you're very sure those deps will always be "whatever's available from Debian today". Homebrew's great for installing your tools. It's not good for project deps. Again, that's far from being just a Homebrew problem.

deleted 4y ago

[deleted]

BillinghamJ 4y ago

You could always manage your packages and their dependencies yourself. Or you could release a new package manager which does provide support for that functionality, build out a team of maintainers, and stay on top of all the releases

gizmo 4y ago
That's like saying "if you don't like your country, start your own". The goal isn't to abandon homebrew, but to have it not break things all the time.
- notpushkin 4y ago
  It's really not. It's borderline impossible (pun intended) to start your own country, mainly because you need to find a piece of land first. Starting a package manager is, like, a few months of work?
tacker2000 4y ago
Thats such a cop out answer! So according to you nobody is allowed to criticise anything because “shut up and build it yourself if you dont like it”?

hnlmorg 4y ago

You can specify specific package versions in brew if you want specific versions pinned. The default behaviour of using the latest in repo is correct and is how every package manager works. It’s the behaviour people expect and it’s the behaviour that is arguably more secure (the fact that homebrew is bleeding edge does create issues here but generally speaking my point stands). I believe you pin using the @ symbol followed by a version number. Eg brew install awesome-project@13.0

gizmo 4y ago
This is not at all how every package manager works. On debian if you install a package it will just install that package and it will warn you if dependencies will require upgrading first. It won't upgrade totally unrelated packages and break everything for you. In addition, you have different branches where the debian stable branch is extremely well tested. Homebrew is way, way worse than any other package manager because it just breaks stuff all the time.
- jeroenhd 4y ago
  But the shopify cli, the given example, does depend on nodejs. If you tell Debian's apt to install a package that depends on a newer version of an installed package, it'll update that package for you as well. If Debian stable updates their nodejs package to 19 and you install any package that depends on nodejs, expect to get the nodejs 19 update. The difference here is that Debian pins versions of software per release so you won't run into these situations. That's fine if you're willing to deal with running older software maintained by Debian rather than the original developers, but that's just a choice. From what I can tell, Homebrew acts more like pacman and friends; it expects you to stay up to date, and if you don't it's up to you to fix the problem.
- acdha 4y ago
  > On debian if you install a package it will just install that package and it will warn you if dependencies will require upgrading first. It won't upgrade totally unrelated packages and break everything for you This is exactly how Homebrew works, too. The difference is that Debian won’t ship a new version outside of a major release so if you started with Node 18 you won’t get 19 until next year. Now, of course, developers usually don’t like that so there are non-core repositories which update more frequently … and you get exactly the behavior which Homebrew has. Being oriented at developers just means Homebrew does that by default.

stephenr 4y ago

Homebrew’s dependency resolution was a complete joke the last time I checked it out, but they were completely happy with the laughable results so I won’t be surprised if it hasn’t changed. Essentially it did all dependency resolution at build time (because brew used to have no prebuilt binaries and everyone’s workstation would spend 90 minutes compiling the same things over and over again). But when they added binary distribution they didn’t change the dependency resolution to work like eg deb’s or rpm’s do. It used to be that if you told it to install from source it would thus be able to “detect” your local existing package that provides the dependency. It may just take a while depending on what you’re installing.

callahad 4y ago

I've been using Nix (and, occasionally, MacPorts) instead of Homebrew for a few years now. Works great, and doesn't have that particular issue. If Nix seems like a bridge too far, the Devenv project offers some nice, lightweight porcelain atop the raw Nix experience.

e12e 4y ago
Does nix have pre-built binaries for m1/m2/arm macs? I'm not enjoying having to rebuild clang and gcc as build-deps with macports... :/
- callahad 4y ago
  Yep!

Upvoter33 4y ago

learn to use the free software you are complaining about, that's a first step.

pornel 4y ago

That's a Node problem. They make semver-major breaks on a regular schedule, which is a flabbergasting policy. Besides, you're still in trouble even if you don't upgrade, because then your JS deps will eventually start breaking from a too-old Node. And if you don't upgrade deps, you risk vulnerabilities, and you won't know which one of the 20 "critical" npm reports are ReDoS spam, and which one are actually important.

tiagod 4y ago

I use asdf for tooling I need to keep several versions of. People have also mentioned Nix, but I haven't tried it out yet.

Nihilartikel 4y ago
I wanted to love Nix, and still use it sometimes, but it is unfortunately not very friendly to arbitrary package version selection. Asdf for the worse-is-better win!

thiht 4y ago

> I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency I love it. I'm using a desktop, not a server. I specifically want my dependencies to be always up to date > All I'm asking for is: if I have perfectly working Node 18 and I need to install fcking Shopify CLI, don't fcking install Node 19 and break my whole setup! Tf?! Then install nvm. Nvm will always be latest, the Homebrew packages will always depend on the latest node version, and locally you'll depend on your own node version that you installed with nvm.

vvillena 4y ago

You didn't install "Node 18", you installed "Node". If you want Node 18, grab the "node@18" package instead of "node". This is how Brew has managed this problem for years: problematic dependencies that need to be pinned to specific versions are given specific packages.

silverwind 4y ago
Why can't it allow pinning of all packages like any sane package manager would?
- vvillena 4y ago
  It can: "brew pin <package>"

yamtaddle 4y ago

If you have project dependencies, Homebrew's not a good fit for that—but, crucially, that's far from just being a problem with Homebrew, it's true of most (not all, but most) system package managers. Using a tool-specific system (e.g. nvm), or Docker, or a VM, is far better for reproducibility. Homebrew's better for installing things you're going to use directly, yourself. Like, don't use it to install Postgres system-wide if you need it for some rails "app"—you'll just run into pain the first time you have to git-bisect or go back and fix some older deployed branch and that version was running on some earlier version of Postgres, or the first time you want to work on a second project that relies on a different version. That's not just a Homebrew thing, the same problem applies, to, say, Debian and dpkg—don't use those to install project deps, unless you're very sure those deps will always be "whatever's available from Debian today". Homebrew's great for installing your tools. It's not good for project deps. Again, that's far from being just a Homebrew problem.