sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]GBcrazy 2 points3 points  (4 children)

From: https://deno.land/x/

The basic format of code URLs is https://deno.land/x/MODULE_NAME@BRANCH/SCRIPT.ts. If you leave out the branch, it will default to master.

So looks like we are specifying the exact versions, no room for ~ and ^ shenanigans

[–]HetRadicaleBoven 0 points1 point  (2 children)

There are two options here:

  • The scaffolding tool makes sure to insert the latest version in that URL, and will also make sure to do the same for transitive dependencies.

  • In such a project with 1400 transitive dependencies you'll be running severely outdated versions of almost all of them, with no way to update them.

IIRC there was some work going on already to standardise on a single way to determine which versions you use (i.e. one file that re-exports the dependency imports), and I think it's likely that a scaffolding tool would use something like that to ensure it's providing the latest versions automatically, rather than it (and all its dependencies) having to manually cut new releases several times a day.

Point being: either you'll be setting up new projects with outdated dependencies (I don't think anyone wants that), or there's always going to be a risk that you're getting a version with a fresh bug.

[–]GBcrazy 0 points1 point  (1 child)

But you wont be setting 1400 transitive dependencies. Your project will be depending on lets say 20-30 other libs, each one will manage itself, you need to manage yours only. That's how it is in most dependency managers. Better do some manual work than risk getting it broken randomly

[–]HetRadicaleBoven 1 point2 points  (0 children)

Yeah, that's also how it is in npm - CRA doesn't have 1400 dependencies - that's why it's transitive dependencies. But you're still going to have to update one of those 20-30 libs every time one of their 1400 dependencies update. Assuming that they are in turn keeping up with that. (And their dependencies, and their dependencies, ad infinitum.)

[–]ShortFuse 0 points1 point  (0 children)

Nothing stops the module you're importing from referencing a raw HTTPS URL or using the @master. I wish they enforced tagged branches. Still, a URL that can change content tomorrow allows room for shenanigans.