I am an amateur developper and I deploy my (home oriented) code to containers. This is usually Python and JavaScript.
JavaScript, when saving dependencies for a further npm install
, will pin the libraries to exact specific versions. It is also possible (and recommended) to do that in Python via requirements.txt
.
This allows for strong reproductibility: you always know what is built from what.
The drawback is that one ends up with outdated libraries, which may not be a problem when there are good tests (you may use a "feature" which is actually a bug, but this may not matter since it works and passes the tests), except that there may be security vulnerabilities, and you will be unaware of these.
My question: why is there a default to pin the exact version, instead of the major one?
My understanding is that depending on the libraries, "major" may mean different things and "minor" versions may still break things even if the use of the library was according to the documentation (and not a bypass/shortcut/non-documented feature).
On the other hand, if a library cannot decide on non-breaking changes for documented usage, it may not be a good library to start with.
npm install
currently uses^x.y.z
inpackage.json
, i.e.x.y.z
up to but not includingx+1.0.0
- that is pinning the major version. It'spackage-lock.json
that stores the exact versions of everything in the dependency tree, but you do not necessarily have to use that.