« first day (5173 days earlier)      last day (36 days later) » 

17:19
Once again my project is broken because I used the wrong version specifier (>= instead of ==) for a dependency. How did we manage to make everything about programming so tricky?
 
1 hour later…
18:21
@Aran-Fey I don't know. I've tried to explain how dependency management is crucial at work but apparently I sound like a raving lunatic to everybody else because nobody is bothering to handle this properly. And it's not even hard - basically, you never want for some tool to automatically pick the dependency versions for you. Yet, our entire CI pipeline did that for four years. After I repeatedly pointed out it's bad practice. It builds a project and it just automatically picks the highest
dependency version. Regardless of what you have declared as dependency version in the your project. Therefore, you never have repeatable builds since if you build a project twice, you'd get potentially two different versions of every dependency in it. This was finally changed like 2-3 months ago. When the CI pipeline was switched.
And Node.js is just a nightmare, too. By default if you add a dependency to your project, it does adds it with ^ e.g., ^1.2.3. Which means, the minor and patch versions van vary when you re-install dependencies. Say, you may get 1.4.0 (minor version increased) but not 2.x.x (major version increased).
Technically that should work if the authors respect semver and minor versions don't break anything. In practice, doesn't work because often minor versions do break stuff. Especially when a dependency relies on the version of another dependency. E.g., X version 1.7.x works with Y 2.3.x but changing the minor version of either leads to weird and hard to find problems. You can pin the versions - NPM and other build tools have this built-in nowadays with lock files. Hardly anybody uses them.
I can't believe so many people world-wide just...don't care about any of this. Tools are happy to do stupid shit for no real reason. Leading to many man-months wasted each year chasing preventable things. And very few of the chasers bother, either.
18:37
That sounds like reasonable default behavior tbh. Depending on exact versions is a bad idea for every library, that's only ok for apps
There definitely should be tools that warn you about accidental breakages. Crazy that we don't have that
In the long term, I'd actually like to get rid of version numbers completely. They're crutches that don't contain enough information. Like, sure, upgrading from requests 1.23.7 to requests 2.0 might break my code.… but it also might not. Why can't I depend on "a version of requests that has all the features my library uses"?
@Aran-Fey Only it's been shown to not work at all in any real project. Heck, I've had toy projects that I can't even start due to version mismatch. And I only draw in 2-3 dependencies myself (then each spirals out and may eventually cause version conflict).
Depending on exact versions is not a viable solution though. Not for libraries, at least. What would you do if you depend on foo and on bar, but they each depend on a different version of qux?
The most reasonable behaviour, if we ignore lock files, is to declare ~1.2.3 which means only the patch version can vary. You can also do 1.2.3 which is completely static. And lock files essentially do that. Somebody realised what nighmare dependency management is, so a lock file just looks at what version of dependencies you actually got when you first installed them. So, you could have declare ^1.2.3 but the real version you got was 1.4.3.
The lock file records that and future install just use this every time. So your installations and builds are repeatable.
@Aran-Fey The biggest problem I'd see is the arguments may stay the same but the implementation may differ. Some bugs exists between Python versions because the implementation changed in a breaking way for example. With untyped Python the error rate likely could be worse, and typed Python probably doesn't contain enough to always be right.
Would be cool if taint analysis tools were more developed to build a basic version tho.
18:54
Yeah, we would need to keep track of "semantic" changes like bugfixes. Which is simply unreasonable to expect of any developer in the current state of affairs. But maybe one day we'll manage to leave this technological stone age we're in right now
We need to start reinventing things from scratch instead of making minor upgrades to existing things, pronto
19:10
The solution is AI! /s
 
3 hours later…
21:52
@Aran-Fey there is also ~= to have better control over what can be upgraded to pin minor releases but still get bugfixes
This goes back to our previous discussion where I suggested bumping a minor version if you change the interface. It wouldn't preclude bugfixes but you can't end up with 0.7.0 from 0.6.8 for example
Beyond that, I suspect your ideas for dependency resolution would absolutely explode in complexity. I think it's primarily driven by the order that you specify the major library dependencies, which significantly reduces the number of possible overlapping combinations of subdependencies

« first day (5173 days earlier)      last day (36 days later) »