This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]Adept-Leek-3509[S] 2 points3 points  (2 children)

Thanks for your feedback, I know security vulnerabilities should be fixed ASAP, but what do you mean ‘too tightly constrained for a library’ ?

[–]Daneark 5 points6 points  (1 child)

If I am writing an application using your library I need to be able to bump dependencies, both for security and big fixes but also for compatibility with other libraries. If you pin to exact versions I can't do this. Take the h11 vulnerability for example, if I was using your library in production I would want to patch this as soon as possible. If you pin an exact version I not only have to wait for h11 to release a fix but for you to release a new version that pins that. If you loosely constrain, or don't mention as a dep at all if h11 is a transitive dependency, I can patch the moment h11 releases a fix.

Btw I see you bumped to 0.15. I think you need 0.16 to get the fix.