This feels like a huge dodge. Why do folks control dependencies? Why do so many foundation layers insist on breaking changes?
It is almost ironic, as linux is known for not breaking up the abstraction ladder.
It is almost ironic, as linux is known for not breaking up the abstraction ladder.
- assume that your published version compatibility is correct and let the app fail for some library upgrade in the future
- publish a strict list of dependency versions and keep updating it
- publish a strict list of dependency versions and rely on old versions as long as possible
The first one results in unhappy users, second one in lack of distro packages because you rely on too recent deps, third one either in lack of distro packages because of too old deps or in unhappy users because deps don't work on their new system anymore. There's no way to satisfy everyone unless distributions themselves become aware of multiple levels of package management.
The problem is people depend on you because you provide X. You thought you provided Y. X was just a small side benefit. As a provider, how do you advanced Y without breaking X?
- don't have the dependency in the first place
- supply your own dependencies instead of relying on the environment to provide them for you in ways you can't control
The ideal format for distributing software is a single, self-contained executable program far more often than parts of the developer community would like to admit. So many of these potentially serious problems just don't exist if you use a compiled language and you statically link a controlled set of dependencies at build time.
Obviously you still need to monitor your dependencies for essential updates and then issue updates of your own software to incorporate them when necessary, for example in the event of a security vulnerability being identified and fixed.
And obviously you may still depend on services provided by your host environment that you're communicating with but not incorporating directly.
But at least you always know exactly what your user will be running within your own program, you can test it properly before you ship it, and it won't then mysteriously change because of something they or some other software on their system did that you have no knowledge about or control over.
Your JS fad of the day likely ain't even considering.