Hacker News Reader

Comment by JMTQp8lwXL | Hacker News Reader

This seems to me, to be a package manner implementation detail. The packager manager I am most familiar with, npm, won't have an issue with the diamond problem, since node modules can install nested modules, allowing B and C to both depend on unique versions of D.

View on HN

Effectively rendering B and C incompatible in sharing D objects and structures. Just because you technically can doesn't make it a good thing in software architecture.

There is a reason why most globally linked runtimes (e.g. C++ or Java) do not encourage such mechanisms.

In times of security fixes sometimes there is only one secure version but the whole ecosystem is built around the fact that older, flawed version can still be included. Another drawback is performance, npm install is amazingly slow. In fact package resolution is NP-complete: https://research.swtch.com/version-sat

I generally agree but the problem is even worse :)

Yarn is a bit more sophisticated and has a concept of "resolutions" which would be great for the security use case of forcing a particular version. Even if B and C need different major versions, say D@v1-with-security-fix and D@v2-with-security fix, yarn supports that too, since resolutions can be nested.

https://yarnpkg.com/lang/en/docs/selective-version-resolutio...

What happens when B and C need to pass each other an object from D that's been changed?

Reply on news.ycombinator.com