On Sat, Nov 24, 2018 at 03:41:35PM +0000, Jelle Licht wrote:
> Hey swedebugia,
> I will still send a more elaborate reply to the general npm-importer
> thread later this week, but we can assume that generally these
> recursive dependencies can be untangled by looking at the different
> versions of the dependencies.
> So in your example, I imagine an input chain like:
> node-glob 0.1 -> node-rimraf 0.1 -> node-glob 0.2 -> node-rimraf 0.2
> -> .... -> node-glob 1.0 -> node-rimraf 1.0
> While *extremely* annoying to untangle, this is definitely doable.
Appears to me that it would suffice to pick the latest version. In
What do you mean? In my specific example, you would need to package
and build each version in succession in order to actually be able to
use recent versions of either of these packages. IOW, you can not
choose any; you need to choose each.
case there is no clear version info just pick whatever is there.
In general this should work. Any unit tests should show breakage.
If only we could run unit tests for most packages. Most test
frameworks have huge list of transitive dependencies, although not
nearly as bad as the build tooling.
Circular dependencies are (unfortunately) getting more common. Not
only in npm, but in all ad hoc package managers. I think their
assumption is too that you pick the latest.
I agree that we should expose the latest-and-greatest (and secure)
version of most packages, but we would still need to build older
intermediate releases in order to have reproducible builds from source
in a lot of cases. Whether we should expose these bootstrap packages
as well is another issue. Am I perhaps missing the point you are making?
Pj.