Post #2015765
2026-05-04 16:46 UTC
people somewhat frequently complain about Python packaging’s assumption that each package can only resolve to a single version, but I actually think that was a pretty great outcome compared to having 3+ incompatible versions of the same package in your dep tree. Good example of constraints (even unintended ones) being liberating
Replies (3)
-
@andrewnez@mastodon.social 2026-05-04 16:51
@yossarian@infosec.exchange don't get me started, how javascript people think "this solves dependency hell" only tells me they've not experienced their frontend containing both Angular 1 and Angular 2 as transitive dependencies.
-
@hynek@mastodon.social 2026-05-04 17:26
@yossarian@infosec.exchange Each with its own (different) set of CVEs 🥲
-
@djc@hachyderm.io 2026-05-04 18:02
@yossarian@infosec.exchange so can you only unlock a dependency upgrade once all its dependents in your graph have also upgraded?