3 ms·

That‘s why there is a lock file. The package manager and node version can likewise be locked.

by quonn 3y ago

ahmedfromtunis 3y ago
Does the lock file render the need to update dependencies obsolete? Of course not. It just avoids that the build system *automatically* updates X to 1.2.3 and *accidentally* breaks your code. But when it's time to bump the version up a notch, that very fragile equilibrium may suddenly crumble. Lock files are not a substitute for sane dependency management.
- quonn 3y ago
  I responded to someone who claimed that it broke by itself after 6 months. Lock files prevent this.
- satvikpendem 3y ago
  This is the same in any language then.
  - ahmedfromtunis 3y ago
    Some stacks are just more finicky than others: https://news.ycombinator.com/item?id=38959190 https://news.ycombinator.com/item?id=38959190
- zdragnar 3y ago
  There's no reason that you absolutely have to update every dependency after 6 months. Not updating anything at all is perfectly fine. Nobody in their right mind thinks you can change major versions without some elbow grease in any other language.
  - ahmedfromtunis 3y ago
    > Nobody in their right mind thinks you can change major versions without some elbow grease in any other language. I have an old project that I didn't touch in more than 5 years. Last week, I decided to give it another spin, and booked the entire afternoon to deal with any issues that may arise from the update process. It went from Python 3.6 to 3.11, and from Django 2.2 to 4.2. Postgres jumped from 11 to 16! There were 10 other libraries (PIL, ...) that I had to update too. The only special procedure that I had to do was dumping data from the old database and restoring it from the new one, as recommended by PG when doing major-point updates. (And adding a single line to Django's `settings.py` for the new `CSRF_TRUSTED_ORIGINS`.) When I typed `docker compose up` on my terminal, the app just run smoothly without as single problem. I even had to check that I didn't invoke the old configuration by mistake. All in all, the process took me less than 15 minutes.
gkbrk 3y ago
Yeah, just lock your versions without updating in the JS ecosystem with typical projects having thousands of dependencies, and watch your CVE count go up every day you don't update.

That‘s why there is a lock file. The package manager and node version can likewise be locked.

by quonn 3y ago

That‘s why there is a lock file. The package manager and node version can likewise be locked.

Does the lock file render the need to update dependencies obsolete? Of course not. It just avoids that the build system *automatically* updates X to 1.2.3 and *accidentally* breaks your code. But when it's time to bump the version up a notch, that very fragile equilibrium may suddenly crumble. Lock files are not a substitute for sane dependency management.

quonn 3y ago
I responded to someone who claimed that it broke by itself after 6 months. Lock files prevent this.
satvikpendem 3y ago
This is the same in any language then.
- ahmedfromtunis 3y ago
  Some stacks are just more finicky than others: https://news.ycombinator.com/item?id=38959190 https://news.ycombinator.com/item?id=38959190
zdragnar 3y ago
There's no reason that you absolutely have to update every dependency after 6 months. Not updating anything at all is perfectly fine. Nobody in their right mind thinks you can change major versions without some elbow grease in any other language.
- ahmedfromtunis 3y ago
  > Nobody in their right mind thinks you can change major versions without some elbow grease in any other language. I have an old project that I didn't touch in more than 5 years. Last week, I decided to give it another spin, and booked the entire afternoon to deal with any issues that may arise from the update process. It went from Python 3.6 to 3.11, and from Django 2.2 to 4.2. Postgres jumped from 11 to 16! There were 10 other libraries (PIL, ...) that I had to update too. The only special procedure that I had to do was dumping data from the old database and restoring it from the new one, as recommended by PG when doing major-point updates. (And adding a single line to Django's `settings.py` for the new `CSRF_TRUSTED_ORIGINS`.) When I typed `docker compose up` on my terminal, the app just run smoothly without as single problem. I even had to check that I didn't invoke the old configuration by mistake. All in all, the process took me less than 15 minutes.

gkbrk 3y ago

Yeah, just lock your versions without updating in the JS ecosystem with typical projects having thousands of dependencies, and watch your CVE count go up every day you don't update.