[Proposal] mix deps.update limited to the latest minor or patch version

[Marco Polita]

Adding a flag that would be considered by mix deps.update for updating dependencies only to the latest patch or minor version, without bumping minor or major.

Example:

package "magico" has the following releases:

- 1.0.0

- 1.0.3

- 1.6.0

- 1.6.4

- 2.0.0

Project "example"'s mix.lock file defines "magico" 1.0.0

running the following commands in the project would have the following outcomes

`mix deps.update magico` would update to 2.0.0

`mix deps.update magico --patch-version` would update to 1.0.3

`mix deps.update magico --minor-version` would update to 1.6.4

REASON:

Facilitating the maintainance cycle of a project by allowing quicker, safer dependencies bumps by updating only to the latest patched version.

[Jon Rowe]

Hi Marco

Are you aware that this behaviour is already facilitated by `mix.exs`? When specifying your dependencies you can control how mix will look for updates, using `~> 1.0.0` will mean `mix deps.update magico` will only update to `1.0.3`, if you specify `~> 1.0` then it will update to 1.6.4 (minor) and if you specify `> 1.0.0` it would update to `2.0.9`

Cheers

Jon

--

You received this message because you are subscribed to the Google Groups "elixir-lang-core" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elixir-lang-co...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/elixir-lang-core/c2f57392-435a-4721-b2f2-3c20612511ebn%40googlegroups.com.

[Marco Polita]

Hi Jon,

I'm aware of the mechanisms of `mix.exs`, my proposal is for facilitating situations in which is useful to do a bump of the whole project dependencies.

In my work experience it happened often that dependencies are just periodically bumped up all together without checking the changelogs, mainly because most of them are bumped by a patch version, but that's not always the case.

Having a flag that guarantees that only the patch version is bumped up would allow this task to be a no-brainer.

In a situation like this, specifiying the whole dependency version in `mix.exs` would act as an additional "protection" mechanism from updating minor versions, but I also think is generally more common to just specify MAJOR.MINOR making `--patch-version` useful.

[Marco Polita]

Ruby bundle also offers a similar functionality https://bundler.io/v2.4/man/bundle-update.1.html

[Jon Rowe]

Hi Marco

Just checking you were aware this functionality already existed, albiet in a different form, I don’t know enough about the version resolution internals to know how much extra maintenance burden this seperate flag would be.

Personally it seems strange to me to explicitly allow updating minor versions in `mix.exs` and then only bump versions by a patch level, if you want just patch level increases you can specify that in your `mix.exs`, I concur with you that it's more common to allow updating minor versions as well, because Elixir libraries tend to offer semver so a post 1.0.0 library can safely update to minor versions without problems. Equally I personally tend to update one / or a cluster of related depedencies at a time, commit and run CI etc.

Ruby’s bundler tool doesn’t allow the shortened form of major.minor so it needs different tools to achieve the same thing.

Cheers

Jon

To view this discussion on the web visit https://groups.google.com/d/msgid/elixir-lang-core/897d9d03-b135-47ef-bd19-9336f3b1914dn%40googlegroups.com.