Hacker News Reader

Comment by jjnoakes | Hacker News Reader

What do you do when a dependency has a security problem? Or some other bug?

Its generally unlikely those things lead to interface changes. e.g. func bcrypt(salt string, password string). Generally the bug isn't in the interface. So its somewhat safe to upgrade the dep and see if the compiler complains

Also exporting of interfaces is protected by case private()/Public() which leads to refined interfaces being exported. And the go vet tool expects all exported functions be documented.

Not saying a package manager wouldn't be nice.

This didn't directly answer my question, but it implies that you just periodically update all of your dependencies to the latest versions and pray your tests pass with minimal changes required.

Yes?

The tools essentially causes that to happen (its a bad thing). When someone installs your package (and you don't pin them somehow with something like godeps, path management, http://labix.org/gopkg.in, etc) you recursively retrieve the deps from some source at HEAD and that package is now updated for every other package using that GOPATH.

Oh, I misread the parent I replied to. I thought he was saying he downloads a copy of his dependencies and commits them to his repository without any tooling.

But he was only saying he uses the tools (which auto-update as your run them), and commits the result as a poor man's pinning arrangement.

Makes sense now. My questions are moot.

Reply on news.ycombinator.com