Skip to content
This repository has been archived by the owner on Sep 9, 2020. It is now read-only.

FAQ - pinning version of a direct dependency #736

Merged
merged 1 commit into from
Jun 11, 2017
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions FAQ.md
Original file line number Diff line number Diff line change
Expand Up @@ -85,11 +85,29 @@ Here are some suggestions for when you could use `dep` or `go get`:
-[@sdboyer in #376](https://github.com/golang/dep/issues/376#issuecomment-294045873)

## Why is `dep` ignoring a version constraint in the manifest?
Only your project's directly imported dependencies are affected by a `dependencies` entry
Only your project's directly imported dependencies are affected by a `constraint` entry
in the manifest. Transitive dependencies are unaffected.

Use an `overrides` entry for transitive dependencies.

By default, when you specify a version without an operator, such as `~` or `=`,
`dep` automatically adds a caret operator, `^`. The caret operator pins the
left-most non-zero digit in the version. For example:
```
^1.2.3 means 1.2.3 <= X < 2.0.0
^0.2.3 means 0.2.3 <= X < 0.3.0
^0.0.3 means 0.0.3 <= X < 0.0.4
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i know this is what rust does, but i don't think this is what we actually do. I believe that ^0.0.3 is equivalent to 0.0.3 <= X < 0.1.0.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sdboyer is it a flaw in our implementation or is it by design?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doh! I should have checked with the source directly. 😊 https://github.com/Masterminds/semver/#caret-range-comparisons-major. Yeah I just double-checked that our semver package considers ^0.0.3 to be 0.0.3 <= X < 0.1.0.

```

To pin a version of direct dependency in manifest, prefix the version with `=`.
For example:
```
[[constraint]]
name = "github.com/pkg/errors"
version = "=0.8.0"
```


## How do I constrain a transitive dependency's version?
First, if you're wondering about this because you're trying to keep the version
of the transitive dependency from changing, then you're working against `dep`'s
Expand All @@ -110,7 +128,7 @@ behave differently:
* Dependencies:
1. Can be declared by any project's manifest, yours or a dependency
2. Apply only to direct dependencies of the project declaring the constraint
3. Must not conflict with the `dependencies` declared in any other project's manifest
3. Must not conflict with the `constraint` entries declared in any other project's manifest
* Overrides:
1. Are only utilized from the current/your project's manifest
2. Apply globally, to direct and transitive dependencies
Expand Down