Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Ask HN: Why is dependency management hard?
3 points by jrvarela56 on June 5, 2023 | hide | past | favorite | 2 comments
I've been battling lately with a js/ts project and have seen issues with python too. Ruby on the other hand, I haven't had a single issue with bundler in +12 years.


JS has the problem that there are so many dependencies in a typical project. I'm not so sure if the approach it takes to managing peer dependencies now is correct, but certainly the React community thinks it is incorrect and people are stuck with the quite incorrect legacyPeerDeps. It is a strength of npm and the JS module system that each dependency can import the versions of other dependency that it needs avoiding "diamond dependencies" that dog super-general libraries like Guava in Java. See

https://lexi-lambda.github.io/blog/2016/08/24/understanding-...

I think a Python-based dependency resolver could be as reliable as maven is for Java if it only worked on wheels and takes advantage of this new feature

https://discuss.python.org/t/pep-658-is-now-live-on-pypi/266...

Pip and similar tools in Python have so far used half-baked strategies that don't properly handle cases where there are conflicts. pip would just install the first package on the list and then install the dependencies of the packages that it needs and so on... If it runs into another package which is not compatible with what is installed it doesn't have a strategy to recover. (With eggs it is awful because you have no way of knowing what dependencies a package has until to run it, and pip evolved in that world.

Now that you can download the METADATA you can write something that downloads and caches the dependency relationships and finds a solution globally.

In fact, conda does that already, and conda even has a systematic approach to the problem of "What if I do if a package I need is egg-only or not in the central repository?" which is basically make your own wheel for your own environment and put it in a private repository.


Your computer is a library. Managing symbols are exactly as hard as maintaining a brick and mortar library's usefulness for users.

For some odd reason, we seem to glaze over that part nowadays for one reason or another.




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: