undefined | Better HN

0 pointsgombosg5y ago0 comments

Exactly. We use Renovatebot for the same purpose. It pins dependencies and creates PRs for updates. Amazing to see how often the builds break, even sometimes after minor updates. But at least we fix them before release, and not after... :)

0 comments

jakear5y ago

Yep. One of the very nice things about npm/node versus python or go or some others is that package locks and dependency pinning is possible. But few people seem to use it.

I’ve seen reports of people using a go library that gets a minor update and breaks their app, at which point they become SOL as go always installs the lad test version. I myself have been working in python projects where the dockerfile simply says “pip install blah” and I get different deps than the working version. No clue why anyone would be okay with working like that.

jen205y ago

It's not true that Go always installs the latest version of a dependency. `go get github.com/x/y@v1.3.4` installs v1.3.4 of x/y, assuming there is a tag matching that.

jakear5y ago

I’m not familiar with go, would this persist to other people attempting to install the package?

The issue I’ve seen is:

https://github.com/go-yaml/yaml/issues/558

> Please do follow semver as it's a nightmare for us to manage particularly using go module (you can't stick to a particular version).

And of course everybody’s idea of a breaking change is different, so this idea that you can’t install a particular version seems unworkable.

j / k navigate · click thread line to collapse

0 comments

jakear5y ago

Yep. One of the very nice things about npm/node versus python or go or some others is that package locks and dependency pinning is possible. But few people seem to use it.

jen205y ago

It's not true that Go always installs the latest version of a dependency. `go get github.com/x/y@v1.3.4` installs v1.3.4 of x/y, assuming there is a tag matching that.

jakear5y ago

I’m not familiar with go, would this persist to other people attempting to install the package?

The issue I’ve seen is:

https://github.com/go-yaml/yaml/issues/558

> Please do follow semver as it's a nightmare for us to manage particularly using go module (you can't stick to a particular version).

And of course everybody’s idea of a breaking change is different, so this idea that you can’t install a particular version seems unworkable.

j / k navigate · click thread line to collapse