Re: Pinned/fixed versions should be a requirement

2023-09-27 Thread Development of GNU Guix and the GNU System distribution.
The dependency graph visualization has been discussed by others more knowledgable of the Guix ecosystem than me, so I'll focus on titled topic. On 2023-09-04 at 21:59-05:00, Distopico wrote: > `rust-my-lib-1`, where "1" refers to the semver "1.x" of the package, > e.g., "1.0.32", and `rust-foo` de

Re: Pinned/fixed versions should be a requirement.

2023-09-09 Thread Liliana Marie Prikler
Am Samstag, dem 09.09.2023 um 20:37 -0500 schrieb Distopico: > > On 2023-09-10, Liliana Marie Prikler > wrote: > > > > [bunch of stuff regarding Rust] > > > Beyond Rust, an example of a language/packages ecosystem that does > not follow semantic versioning at all is JavaScript/Npm. Most > pack

Re: Pinned/fixed versions should be a requirement.

2023-09-09 Thread Distopico
On 2023-09-10, Liliana Marie Prikler wrote: Hi Liliana, >> This is problematic because: >> >>     - Over time, it becomes more vulnerable to libraries/packages >>   breaking. >> >>     - It makes reproducible software more challenging, as "1.x" can >>   encompass many versions. >> >

Re: Pinned/fixed versions should be a requirement.

2023-09-09 Thread Liliana Marie Prikler
In this thread: Rust has a broken packaging model, so let's apply that. Am Montag, dem 04.09.2023 um 21:59 -0500 schrieb Distopico: > Many libraries in different languages don't follow semver, which can > lead to cases like `rust-serde-json`, which, between versions > "1.0.97" and "1.0.98," change

Re: Pinned/fixed versions should be a requirement.

2023-09-09 Thread Attila Lendvai
> For these reasons, I believe that pinned versions should be a > requirement in libraries, always specifying the exact dependency, for > example, `rust-serde-json-1.0.98`. aiming a little higher, we could stop using module-global variables for pointing to packages (aka define-public), and with

Re: Pinned/fixed versions should be a requirement.

2023-09-05 Thread wolf
On 2023-09-04 21:59:47 -0500, Distopico wrote: > > In my experience using Guix and attempting to make contributions, I've > noticed that the vast majority of times when a library breaks, it's > because one of its dependencies changed version. For instance, > referencing something like `rust-my-lib

Pinned/fixed versions should be a requirement.

2023-09-04 Thread Distopico
In my experience using Guix and attempting to make contributions, I've noticed that the vast majority of times when a library breaks, it's because one of its dependencies changed version. For instance, referencing something like `rust-my-lib-1`, where "1" refers to the semver "1.x" of the package,