18:21
@Aran-Fey I don't know. I've tried to explain how dependency management is crucial at work but apparently I sound like a raving lunatic to everybody else because nobody is bothering to handle this properly. And it's not even hard - basically, you never want for some tool to automatically pick the dependency versions for you. Yet, our entire CI pipeline did that for four years. After I repeatedly pointed out it's bad practice. It builds a project and it just automatically picks the highest
dependency version. Regardless of what you have declared as dependency version in the your project. Therefore, you never have repeatable builds since if you build a project twice, you'd get potentially two different versions of every dependency in it. This was finally changed like 2-3 months ago. When the CI pipeline was switched.
And Node.js is just a nightmare, too. By default if you add a dependency to your project, it does adds it with ^
e.g., ^1.2.3
. Which means, the minor and patch versions van vary when you re-install dependencies. Say, you may get 1.4.0 (minor version increased) but not 2.x.x (major version increased).
Technically that should work if the authors respect semver and minor versions don't break anything. In practice, doesn't work because often minor versions do break stuff. Especially when a dependency relies on the version of another dependency. E.g., X version 1.7.x works with Y 2.3.x but changing the minor version of either leads to weird and hard to find problems. You can pin the versions - NPM and other build tools have this built-in nowadays with lock files. Hardly anybody uses them.
I can't believe so many people world-wide just...don't care about any of this. Tools are happy to do stupid shit for no real reason. Leading to many man-months wasted each year chasing preventable things. And very few of the chasers bother, either.