This is why regression suites are important.
EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).
EDIT: I wasn't dissing the developers. They have regression, this was just an accident. I was stating it is important. My bad (too late to delete).
See https://github.com/then/is-promise/blob/master/.travis.yml (missing v11, v12, v13, v14)
I’ve seen reports of people using a go library that gets a minor update and breaks their app, at which point they become SOL as go always installs the lad test version. I myself have been working in python projects where the dockerfile simply says “pip install blah” and I get different deps than the working version. No clue why anyone would be okay with working like that.
The issue I’ve seen is:
https://github.com/go-yaml/yaml/issues/558
> Please do follow semver as it's a nightmare for us to manage particularly using go module (you can't stick to a particular version).
And of course everybody’s idea of a breaking change is different, so this idea that you can’t install a particular version seems unworkable.
Of course, you can always lock your build to exact versions of your dependencies (lock files in NPM used to be a complete cluster, in my opinion they are less of a cluster now - you can pretty much do everything you want with them but there are some gotchas that make it easy to shoot yourself in the foot). The issue is that when you run 'npm install', it will pull the latest semver-compatible versions of your dependencies.
So for everyone decrying how this is a bad example of NPM and the javascript ecosystem, I really think the opposite is true. Yes, it broke a lot of upstream dependencies, but importantly only for new builds of those items, and furthermore it was found almost immediately.
Also, of course, you can specify exact versions of your dependencies - you don't have to rely on semver. That means, though, that you need to be more vigilant about pulling in bug fixed and security fixes, and most people take the tradeoff that they are comfortable pulling in patch or minor versions, but using lock files once they have a build they have verified.
And the system under test shouldn't even compile for the tests to run either. So it isn't so much the regression suite saving you so much as it is just acting as the client of first resort.
> innumerable backdoors in the JavaScript ecosystem.
Same goes for Python and CPAN. Any "click here for fancy module" installer has this problem.
Open up any serious Python project and you'll find significant dependencies. Math, graphics, IO, stats, ML... anything you really want to do requires dependencies. In fact, one of my biggest issues with Python is the cross-platform incompatibility of many packages which makes it a terrible choice for my deployment. (Even worse if the project has Cython components!)
I often end up having to scour github for forked pywheels that aren't vetted. Which are then cloned ad infinitum.
Its a tradeoff between extensibility and open source / free software, and robustness.
Graphics -> Python comes with included Tkinter, and others are also one include away.
Stats -> Scipy does a lot of the stuff. There is a built in package for stats. Again, no stats package has 100 dependencies, and node doesn't even have anything with even 1/10th of the features
ML -> I mean node has nothing here, nothing, while pytorch has total of six dependencies. In node, left pad might have these many.
Python doesn't need left pad, isNumber, isInteger, isOdd, isPromise , take your pic.
> In fact, one of my biggest issues with Python is the cross-platform incompatibility of many packages which makes it a terrible choice for my deployment. (Even worse if the project has Cython components!)
But python has high performance libraries written in C, can you even use node for any of the cases where python has platform compat issues?
It is a tradeoff, and there is no comparison. Python needs far far less dependencies than node. e.g, Flask has 2 total dependencies, express has 48 direct dependencies, and even then flask comes out ahead on features, so much so that you would need many more packages to do the same stuff with express.