Upgrading launch-darkly-sdk gem pessimistically constrains gem dependencies for json and http

[bethanyr]

Is this a support request?
no

Describe the bug
I am upgrading the launch-darkly-sdk version from 5.5.7 to 6.2.0 and noticed that our json gem version is being downgraded to 2.3.1 from 2.5.1.

I also would like to use the 5.0 version of the http gem but am unable to use that version because launch-darkly-sdk requires version 4.4.1

To reproduce
Add newer versions of the json and http gems to a gemfile that includes launch-darkly-sdk and run bundle install

Expected behavior
I am able to install json 2.5.1 and http 5.0, but instead get the following messages:

Bundler could not find compatible versions for gem "http":
  In Gemfile:
    http (~> 5.0)

    launchdarkly-server-sdk (~> 6.0) was resolved to 6.2.0, which depends on
      http (~> 4.4.1)

Bundler could not find compatible versions for gem "json":
  In Gemfile:
    json (~> 2.5.1)

    launchdarkly-server-sdk (~> 6.0) was resolved to 6.2.0, which depends on
      json (~> 2.3.1)

SDK version
6.2.0

Additional context
I would like to use http 5.0 which does not rely on http-parser gem (which is no longer being maintained)

[eli-darkly]

Thanks for bringing this up. There are two somewhat different issues here.

In the case of json, I believe our version constraint is overly specific and we should be able to change it from ~> 2.3.1 to ~> 2.3, which would allow any higher 2.x version. I think that the stricter constraint is obsolete, left over from a time when we had to support older Ruby versions that weren't compatible with later json versions.

In the case of http, while we should similarly be able to relax that constraint to allow higher 4.x versions, I can't say for sure whether we'll be able to support 5.x at the moment. By semantic versioning rules, it is almost always best for a dependency to be constrained by major version, because a 5.x version of a library is likely to break code that was designed to use a 4.x version— otherwise they wouldn't have called it 5.x instead of 4.x; the numbering implies that it's not backward-compatible. But for the same reason, if we changed our SDK to require version 5.x of http, we would be breaking things for customers who are using 4.x. And since http 5.x is relatively new and not nearly as popular as 4.x, that would be likely to harm more customers than it helps.

However, it might be that the breaking changes in http 5.x are few enough that we can write our code to not use the APIs that have changed, or (though this is not a great practice) to detect the presence or absence of particular APIs dynamically at runtime. If so, we could change the constraint to be >= 4.4.1 and < 6.0.0. But, again, I can't say for sure that that is feasible; it'll take a more careful review of how we're using the library. I agree that it'd be desirable to support 5.0, in particular because it doesn't use http-parser, but it is probably too soon to require it.

[eli-darkly]

I've verified that the SDK works in all supported Ruby versions with json 2.5.1, so we can definitely fix that one.

[bethanyr]

@eli-darkly - thank you for the quick response - I realize I probably should have opened 2 issues since the http is a major version jump as you point out. It would be great if you can fix the json version requirements, since we are currently using json 2.5.1 with the launch-darkly-sdk 5.5.7 - and we are trying to do a better job of keeping our gem versions updated 😄 .

[eli-darkly]

@bethanyr It's fine to track this as a single issue - we would've had to investigate the compatibilities either way.

It looks to me like we can allow v5.x of http. Based on their changelog, the breaking changes in 5.0.0 don't affect anything that we are doing, and my testing backs that up. So unless I find some unexpected problem, we should be able to relax that constraint to >= 4.4.1, < 6.0.0.

[eli-darkly]

Version 6.2.4 has been released with these dependency changes.

[bethanyr]

thank you! I have updated to the latest gem in my project and see the expected json and http gem versions. Thank you for your quick change!