✨Ben Hamill✨ utilise witches.town. Vous pouvez læ suivre et interagir si vous possédez un compte quelque part dans le "fediverse".

dependency management problems are a thing irrespective of the license of those dependencies. nobody anywhere is writing assembly code entirely on their own, even then you depend on a compiler. every software project has dependencies. it's a problem solved by version pinning. i can't believe a tech writer wrote this?

@Gargron version pinning means you are potentially missing important bug fixes during codebase refactoring which were actually vulnerability fixes that didn’t get CVEs assigned

@feld no. you gotta be paying attention to new releases of your dependencies (there are tools for this), but version pinning means you don't get unexpected breaking changes from someone else's code.

@Gargron I’ve only witnessed it used to freeze that code for eternity because keeping your codebase compatible with the latest releases of your dependencies is “too much work”
✨Ben Hamill✨ @benhamill

@feld @Gargron I have used it on various production systems for years so that I choose when and how to manage the complexity of upgrading a dependency instead of the dependency authors choosing. It means I can finish out some feature branch before getting into upgrade work. Or, even better, several developers on active feature branches don't all have to figure out a version upgrade just to get the project to build.