3 ms·

I don't know how build systems work at lower levels, but things move so fast in the web development world that it renders your codebase inoperable if you don't

I don't know how build systems work at lower levels, but things move so fast in the web development world that it renders your codebase inoperable if you don't maintain it. I've had a codebase that sat for as little as 6 months without me touching it. When I tried to run it again, I ran into so many compatibility issues that I had to tediously copy out all of my code into a new project and then fix the remaining issues with my code itself. Web dev build systems are dependencies on top of dependencies on top of dependencies, and they're all introducing breaking changes every other week it seems.

quonn 3y ago
That‘s why there is a lock file. The package manager and node version can likewise be locked.
- ahmedfromtunis 3y ago
  Does the lock file render the need to update dependencies obsolete? Of course not. It just avoids that the build system *automatically* updates X to 1.2.3 and *accidentally* breaks your code. But when it's time to bump the version up a notch, that very fragile equilibrium may suddenly crumble. Lock files are not a substitute for sane dependency management.
  - quonn 3y ago
    I responded to someone who claimed that it broke by itself after 6 months. Lock files prevent this.
  - satvikpendem 3y ago
    This is the same in any language then.
    - ahmedfromtunis 3y ago
      Some stacks are just more finicky than others: https://news.ycombinator.com/item?id=38959190 https://news.ycombinator.com/item?id=38959190
  - zdragnar 3y ago
    There's no reason that you absolutely have to update every dependency after 6 months. Not updating anything at all is perfectly fine. Nobody in their right mind thinks you can change major versions without some elbow grease in any other language.
    - ahmedfromtunis 3y ago
      > Nobody in their right mind thinks you can change major versions without some elbow grease in any other language. I have an old project that I didn't touch in more than 5 years. Last week, I decided to give it another spin, and booked the entire afternoon to deal with any issues that may arise from the update process. It went from Python 3.6 to 3.11, and from Django 2.2 to 4.2. Postgres jumped from 11 to 16! There were 10 other libraries (PIL, ...) that I had to update too. The only special procedure that I had to do was dumping data from the old database and restoring it from the new one, as recommended by PG when doing major-point updates. (And adding a single line to Django's `settings.py` for the new `CSRF_TRUSTED_ORIGINS`.) When I typed `docker compose up` on my terminal, the app just run smoothly without as single problem. I even had to check that I didn't invoke the old configuration by mistake. All in all, the process took me less than 15 minutes.
- gkbrk 3y ago
  Yeah, just lock your versions without updating in the JS ecosystem with typical projects having thousands of dependencies, and watch your CVE count go up every day you don't update.
palmfacehn 3y ago
Inevitably someone will respond claiming that if you don't like the current ball of duct tape, it is because, "you haven't wrapped this weeks hottest flavor of duct tape as yet another layer on top" There's something seriously wrong with modern front end tooling when the norm is downloading hundreds of dependencies to display semi-interactive text in a browser.
- yoyohello13 3y ago
  > downloading hundreds of dependencies to display semi-interactive text in a browser. I think you mean thousands.

quonn 3y ago

That‘s why there is a lock file. The package manager and node version can likewise be locked.

ahmedfromtunis 3y ago
Does the lock file render the need to update dependencies obsolete? Of course not. It just avoids that the build system *automatically* updates X to 1.2.3 and *accidentally* breaks your code. But when it's time to bump the version up a notch, that very fragile equilibrium may suddenly crumble. Lock files are not a substitute for sane dependency management.
- quonn 3y ago
  I responded to someone who claimed that it broke by itself after 6 months. Lock files prevent this.
- satvikpendem 3y ago
  This is the same in any language then.
  - ahmedfromtunis 3y ago
    Some stacks are just more finicky than others: https://news.ycombinator.com/item?id=38959190 https://news.ycombinator.com/item?id=38959190
- zdragnar 3y ago
  There's no reason that you absolutely have to update every dependency after 6 months. Not updating anything at all is perfectly fine. Nobody in their right mind thinks you can change major versions without some elbow grease in any other language.
  - ahmedfromtunis 3y ago
    > Nobody in their right mind thinks you can change major versions without some elbow grease in any other language. I have an old project that I didn't touch in more than 5 years. Last week, I decided to give it another spin, and booked the entire afternoon to deal with any issues that may arise from the update process. It went from Python 3.6 to 3.11, and from Django 2.2 to 4.2. Postgres jumped from 11 to 16! There were 10 other libraries (PIL, ...) that I had to update too. The only special procedure that I had to do was dumping data from the old database and restoring it from the new one, as recommended by PG when doing major-point updates. (And adding a single line to Django's `settings.py` for the new `CSRF_TRUSTED_ORIGINS`.) When I typed `docker compose up` on my terminal, the app just run smoothly without as single problem. I even had to check that I didn't invoke the old configuration by mistake. All in all, the process took me less than 15 minutes.
gkbrk 3y ago
Yeah, just lock your versions without updating in the JS ecosystem with typical projects having thousands of dependencies, and watch your CVE count go up every day you don't update.

palmfacehn 3y ago

Inevitably someone will respond claiming that if you don't like the current ball of duct tape, it is because, "you haven't wrapped this weeks hottest flavor of duct tape as yet another layer on top" There's something seriously wrong with modern front end tooling when the norm is downloading hundreds of dependencies to display semi-interactive text in a browser.

yoyohello13 3y ago
> downloading hundreds of dependencies to display semi-interactive text in a browser. I think you mean thousands.