3 ms·
All those folks telling me to update my dependencies, this is why I don't do it. It's not laziness, it's undeniable foresight.
by vatsachak 2mo ago
All those folks telling me to update my dependencies, this is why I don't do it. It's not laziness, it's undeniable foresight.
- beej71 2mo agoAs long as your versions don't have any security issues...
- abbadadda 2mo agoWhat purpose does “undeniable” serve here? This tips over into hyperbole, in my opinion, whereas “it’s foresight” is much simpler and stronger. YMMV.
- pluralmonad 2mo agoI think it was to make the tongue-in-cheek nature of the comment more apparent.
- jfklgkdkdnn 2mo agoThat’s undeniable.
- pixl97 2mo agoI mean, yes, update your dependencies. But probably after a week or so after they've been release and tested by the first penguins willing to jump into the ocean.
- kmeisthax 2mo agoHolding periods for new updates are a good idea, but I would also prefer having a tool that could provide diffs of the entire project state pre- and post-update; including transitive dependencies being added or removed. Git diffs won't show you that information, by design.
- eslaught 2mo agoWhy not? Cargo.lock includes the transitive dependencies, and Cargo itself reports everything that changes when you do an upgrade. Those are version changes, not code diffs, but it seems entirely tractable.
- kmeisthax 2mo agoI specifically meant a tool that shows code diffs for transitive dependencies.
- rirze 2mo agoThere's a reasonable solution to this. Tools like `cargo-audit` can tell you if a crate has security issues and guide you towards an update. You don't have to blindly update all dependencies this way.