Post #709591
2026-01-05 20:26 UTC
Replies (3)
-
@michael@oldinternet.net 2026-01-05 20:37
@filippo omg thank you for this. I was *just* looking into this today, because we got some automated dependency notification that something was outdated because we had like, something v0.0.0-20201119 in go.sum even though the same package in go.mod was 0.39.0. I will link your post to say “we don't need to do anything”!
-
@diazona@techhub.social 2026-01-05 20:44
@filippo Interesting stuff One nitpick, or perhaps more likely a misunderstanding on my part: I wasn't sure what you meant by lockfiles applying recursively, but if that's referring to pinning the indirect dependencies of the main package, then at least in Python, they *do* apply recursively - at least as far as I understand it, a lockfile is supposed to specify exact versions of every dependency all the way down the graph. The idea is that if you install the exact packages listed in the lockfile and no others in an empty environment, everything should work. Or did you mean something else by applying recursively?
-
@orsinium@fosstodon.org 2026-01-05 20:48
@filippo when Russ Cox started publishing his research on packaging and minimal version selection, i was deep into Python packaging, writing my own package manager (DepHell), dependency resolution included. and i was honestly impressed. then we actually got it in Go and practice confirmed the theory: this is THE BEST package manager and dependency resolver ever made. if nothing else, i'd use Go just for that.