Skip to content
This repository has been archived by the owner on Sep 9, 2020. It is now read-only.

FAQ - pinning version of a direct dependency #736

Merged
merged 1 commit into from
Jun 11, 2017

Conversation

darkowlzz
Copy link
Collaborator

What does this do / why do we need it?

  • Add pinning a version of direct dependency.
  • Replace old dependencies with constraint.

Which issue(s) does this PR fix?

fixes #734

Copy link
Collaborator

@carolynvs carolynvs left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for thinking of the FAQ! ❤️

FAQ.md Outdated
in the manifest. Transitive dependencies are unaffected.

Use an `overrides` entry for transitive dependencies.

To pin a version of direct dependency in manifest, prefix the version with `=`.
e.g. `version = "=x.y.z"`
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's show a full example with the [constraint] header so that it's clear which one to use.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just realized that we don't explain how we interpret a version without an operator... 😊 Do you mind adding this blurb as well?

By default, when you specify a version without an operator, such as `~` or `=`, `dep` automatically adds a caret operator, `^`. The caret operator pins the left-most non-zero digit in the version. For example:

^1.2.3 means 1.2.3 <= X < 2.0.0
^0.2.3 means 0.2.3 <= X < 0.3.0
^0.0.3 means 0.0.3 <= X < 0.0.4

@darkowlzz darkowlzz force-pushed the faq-constraint-dependencies branch from 623a8b4 to 2dda8af Compare June 9, 2017 18:36
FAQ.md Outdated
version = "=0.8.0"
```

By default, when you specify a version without an operator, such as `~` or `=`,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like it makes more sense to switch the order of these 2 sections. How the default case is handled should come first and then how to pinpoint an exact version.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

totally! 😁

Copy link
Collaborator

@ibrasho ibrasho left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

FAQ.md Outdated
@@ -110,7 +128,7 @@ behave differently:
* Dependencies:
1. Can be declared by any project's manifest, yours or a dependency
2. Apply only to direct dependencies of the project declaring the constraint
3. Must not conflict with the `dependencies` declared in any other project's manifest
3. Must not conflict with the `constraint` declared in any other project's manifest
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another minor thing.

This should be:

Must not conflict with the constraints declared in any other project's manifest

Or at least:

Must not conflict with the constraint entries declared in any other project's manifest

- Add pinning a version of direct dependency.
- Explain default version behavior.
- Replace old `dependencies` with `constraint`.
@darkowlzz darkowlzz force-pushed the faq-constraint-dependencies branch from f845be7 to 55f511f Compare June 10, 2017 10:31
@darkowlzz
Copy link
Collaborator Author

Made all the suggested the changes and squashed to a single commit.

@carolynvs carolynvs merged commit d252483 into golang:master Jun 11, 2017
```
^1.2.3 means 1.2.3 <= X < 2.0.0
^0.2.3 means 0.2.3 <= X < 0.3.0
^0.0.3 means 0.0.3 <= X < 0.0.4
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i know this is what rust does, but i don't think this is what we actually do. I believe that ^0.0.3 is equivalent to 0.0.3 <= X < 0.1.0.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sdboyer is it a flaw in our implementation or is it by design?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Doh! I should have checked with the source directly. 😊 https://github.com/Masterminds/semver/#caret-range-comparisons-major. Yeah I just double-checked that our semver package considers ^0.0.3 to be 0.0.3 <= X < 0.1.0.

darkowlzz added a commit that referenced this pull request Jul 12, 2017
@reorx
Copy link

reorx commented Jul 18, 2017

Why does this useful description not appear on FAQ? It was merged, but FAQ on master has nothing like that now, made me struggled really hard to understand that dep add a ^ in front of version = "X.Y.Z".

Through 3 months of using dep, I have some opinions about version constraint. Firstly this is a really confusing and implicit feature, I haven't seen any other tools that implies version = "X.Y.Z" to be equal to version = "^X.Y.Z". Version management is something very serious, talking about this I always refer to the quote "explicit is better than implicit", but if the authors of dep decided to do that with your concern, that's fine, but please notify the users whatever way that could be more significant than hide in some PR descriptions (#644). There's no straightforward words talk about this feature in FAQ, which is actually the only docs of dep (this is also a sad thing, no formal docs 😞). As user, I would always be tolerant if any mistakes happens, or new feature breaks backward compatibility, those are all OK, because dep is still growing like a child. But this process could be made more friendly, like you can make releases, add changelog to what happens in each version change, also a simple specification could be written for Gopkg.toml if you don't have time to do full documentation (I just noticed the spec exists while writing this). I mean dep is a tool about code management, how can it win user's trust if it can't manage itself decently?

I really appreciate your works on dep, dep is a great tool that gives the community one last standard to rule them all, hope it can get better and better.

@darkowlzz
Copy link
Collaborator Author

@reorx sorry for the trouble. The version operations and detailed docs were recently moved into docs/Gopkg.toml.md as that seemed to be a better place to keep all the Gopkg.toml related docs and the generated Gopkg.toml links to the same docs for more details.

@sdboyer
Copy link
Member

sdboyer commented Aug 3, 2017

@reorx sorry, meant to respond to this earlier. let me go point by point:

Firstly this is a really confusing and implicit feature [...] Version management is something very serious, talking about this I always refer to the quote "explicit is better than implicit", but if the authors of dep decided to do that with your concern, that's fine

Yes, we know it can be confusing. And I think it's fair to say we take the problem of version management quite seriously. I explained a bit about the motivation behind the design choice in #929.

I haven't seen any other tools that implies version = "X.Y.Z" to be equal to version = "^X.Y.Z"

Cargo does.

but please notify the users whatever way that could be more significant than hide in some PR descriptions (#644).

Providing communication channels is, of course, a difficult problem in general.

In the case of #644, we were very clear and public about the file format not being stable, and that committing/building CI around it was a bad idea, and you should only do so with the knowledge that it would break later. It was the first thing (after a couple-sentence summary) in the README. And, in the regular updates I try to be careful about announcing things like this - indeed, it was the very first sentence of the relevant update.

As user, I would always be tolerant if any mistakes happens, or new feature breaks backward compatibility, those are all OK, because dep is still growing like a child.

As noted in the above-linked status update post, and the README ever since we merged #649, we now make the guarantee that backwards-incompatible changes will not happen to Gopkg.toml and Gopkg.lock.

But this process could be made more friendly, like you can make releases

We now have three releases. We held off on making them until after the config file format was stable, specifically to avoid even giving the impression of stability. The first one was made as soon as we became stable.

We do, however, lack a changelog on these releases. That's something I'd definitely like to do better, but I'm really starting to face a time crunch with all this. @darkowlzz has proposed introducing a system for structuring commit messages that can then generate a changelog; that might help a lot. Or (non-exclusively), a volunteer would also be tremendously helpful. Meanwhile, though, the aforementioned dep status updates typically include a list of significant changes that have come in; these could suffice.

There's no straightforward words talk about this feature in FAQ, which is actually the only docs of dep (this is also a sad thing, no formal docs 😞).

Yes, I've been pained by the lack of formal docs for quite some time now. Our FAQ has grown considerably, and does answer many questions, as do the Gopkg.toml docs that @darkowlzz mentioned. But we do lack end-to-end workflow guides. Other suggestions for docs are welcome - even more welcome would be volunteering to work on writing some 😄

I mean dep is a tool about code management, how can it win user's trust if it can't manage itself decently?

I think we've won a lot of users' trust so far, but there's certainly still a lot more work to do. The actionable items I'm able to take from your points are "changelogs on releases" and "supplement FAQ with guides, and maybe write more on major topic areas". A third might be "make the README better so that people can better find their way to appropriate resources," however, some of your concerns seem like ones that should've been addressed by reading the README.

I really appreciate your works on dep, dep is a great tool that gives the community one last standard to rule them all, hope it can get better and better.

thank you - so do we!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

dep constraint not work correct
6 participants