2026-05-04 16:46 UTC
people somewhat frequently complain about Python packaging’s assumption that each package can only resolve to a single version, but I actually think that was a pretty great outcome compared to having 3+ incompatible versions of the same package in your dep tree. Good example of constraints (even unintended ones) being liberating
Replies (2)
-
@hynek@mastodon.social 2026-05-04 17:26
@yossarian@infosec.exchange Each with its own (different) set of CVEs 🥲
-
@djc@hachyderm.io 2026-05-04 18:02
@yossarian@infosec.exchange so can you only unlock a dependency upgrade once all its dependents in your graph have also upgraded?