Are you afraid of dependencies?

Transcript

1. Are you afraid of
   dependencies?
   Glen Mailer
   @glenathan
   

   View Slide

2. “This module has no
   dependencies”
   

   View Slide

3. Scared
   

   View Slide

4. #1
   Small scope
   no dependencies needed
   

   View Slide

5. #2
   Afraid of dependencies
   Author wanted to have written
   everything themselves
   

   View Slide

6. #3
   Afraid of dependency
   problems
   Author has fallen into
   dependency hell in the past
   

   View Slide

7. Rando on HN https://news.ycombinator.com/item?id=10571452
   “This is why developers should try to avoid
   introducing dependencies. Not at all costs, of
   course, but typical project in JavaScript, Go,
   Ruby, or Python has way, way too many
   dependencies, while little of them have any
   significant benefit.”
   

   View Slide

8. Prominent Clojure community member
   “The ideal number of dependencies for a
   library release (not counting Clojure itself) is
   zero. Obviously, use common sense. If your
   library relies on critical functionality in another
   library, then make the dependency. But if you
   can get by without the dependency (even if
   that means copying some of those "utility"
   functions into your own code and making them
   private) then you will make life easier for
   consumers of your library.”
   

   View Slide

9. What is a dependency
   anyway?
   

   View Slide

10. #1
    Module Loading
    How to load a dependency into
    the system
    

    View Slide

11. #2
    Package Management
    How to add a dependency into
    a project
    

    View Slide

12. Commonalities
    between package
    managers
    

    View Slide

13. Manifest of things to depend on
    A version for each thing
    Download from some central location
    Will pull in dependencies-of-dependencies aka
    transitive dependencies
    Arrange artifacts suitably for runtime module loading
    

    View Slide

14. SemVer.org
    break.feature.fix
    

    View Slide

15. Annex
    https://www.youtube.com/watch?v=JjYAnBhF2JU
    A fact-based dependency system
    

    View Slide

16. Variations

    between package
    managers
    

    View Slide

17. Global v Local
    Test v Dev v Real
    Package/Import symmetry
    Vendoring
    Snapshots
    Ranges
    Lockfiles
    Do Applications need versions?
    X Replaces Y (props to PHP's composer)
    

    View Slide

18. Global v Local
    

    View Slide

19. Dependency Hell
    

    View Slide

20. A B@1 D@1
    C@1 D@2
    

    View Slide

21. Pick a version of D for you
    1. Your app might work
    2. copy-paste from C
    3. upgrade B to work with D@2
    4. don’t use C, write your own thing
    

    View Slide

22. Tell you it can’t resolve
    1. Tell it you know best
    2. copy-paste from C
    3. upgrade B to work with D@2
    4. don’t use C, write your own thing
    :pedantic? :abort
    

    View Slide

23. Allow D@1 and D@2
    to co-exist
    

    View Slide

24. Basically everyone
    “OMG that can’t
    possibly work!?1!”
    

    View Slide

25. Nix
    Cargo
    

    View Slide

26. Allow both to co-exist
    1. Your app might work
    2. copy-paste from C
    3. upgrade B to work with D@2
    4. don’t use C, write your own thing
    

    View Slide

27. Allow co-existence
    What could go wrong?
    

    View Slide

28. More bytes
    

    View Slide

29. Type conflicts from
    transitive dependencies
    

    View Slide

30. Rust: forces a re-export
    JS: mostly duck types
    

    View Slide

31. Is this actually a
    problem?
    

    View Slide

32. The Language of the System
    Hickey 2012
    “Try to avoid
    bespoke
    protocols
    and formats”
    

    View Slide

33. Allow co-existence
    What could go right?
    

    View Slide

34. Less time spent
    keeping up
    Lowered cost
    of creating
    dependencies
    Smaller
    dependencies
    Less reasons

    to change
    Less changes
    

    View Slide

35. View Slide

36. Can we add this
    function into core?
    

    View Slide

37. Single function
    dependencies?
    

    View Slide

38. (map-values f m)
    [handy/map-values "1.0.0"]
    

    View Slide

39. Other Downsides
    

    View Slide

40. Discovery
    Evaluation
    

    View Slide

41. Is this doable in
    Clojure?
    

    View Slide

42. github.com/
    aav/clojure.osgi
    jafingerhut/dolly
    benedekfazekas/mranderson
    technomancy/metaverse
    

    View Slide

43. In Summary
    

    View Slide

44. The current state of
    dependency management
    has room for improvement
    

    View Slide

45. Seek out and explore
    alternative approaches
    

    View Slide

46. Don’t dismiss alternatives
    based only on existing
    experiences
    

    View Slide

47. Thanks
    http://j.mp/afraid-of-dependencies
    

    View Slide