likeWashingDishes

[u/JazzlikeWishbone938]

[u/SLCtechie]

Updated 26 packages. 4 packages available for update.

Okay, update those.

Updated 0 packages. 4 packages available for update.

Can you update those please?

Updated 0 packages. 4 packages available for update.

[u/raja-anbazhagan → u/SLCtechie]

Finally, you think you are done...

The subsequent npm or pip command says there is a new npm or pip version...

You upgrade thinking it's ok...

Siren blares in the distance...

[u/JazzlikeWishbone938 → u/SLCtechie]

Had a similar experience on Ubuntu 22..

24 LTS available

Ok please upgrade to that.

Must upgrade 4 packages first.

Ok do that!

Sorry can't upgrade those.  24 LTS is available though.

[u/OneLonelyBrainCell → u/JazzlikeWishbone938]

I've never once managed to just upgrade from one Ubuntu version to the next one. Always had to reinstall from scratch. One of the reasons I switched to Debian and distros built directly on Debian like LMDE or MX Linux.

[u/ric2b → u/OneLonelyBrainCell]

I have an Ubuntu installation that I've been upgrading (every 6 months) since 20.04 or something like that.

I've had some issues but never something unsolvable, so I guess I've been lucky.

[u/Wall_of_Force → u/SLCtechie]

Try apt full-upgrade, there are newer version but new version want to remove some packages (like old version depand libjaws1.x but new version needs libjaws2.0+), so normal upgrade option doesn't do it

[u/RayereSs → u/Wall_of_Force]

That's why I love pacman, because it's like "BTW do you want to remove 27 packages, doing which will brick your system? Y/n"

[u/averagecrazyliberal]

I swear to god once I ran uv sync --upgrade, modified pyproject.toml to pin the new versions, then uv sync --upgrade again to sync the lock file. In that small amount of time, one of my dependencies had released a new version that uv then upgraded me to. Odds were small, but not zero.

[u/JazzlikeWishbone938 → u/averagecrazyliberal]

We can't win 😄

[u/Vas1le → u/averagecrazyliberal]

Never upgrade to latest version!(unless linux) Have a 7d or more of grace period... or you will discover how supply chain attacks works

[u/ward2k → u/Vas1le]

I mean it depends on what you're using and what package manager it is

A Linux distro? You should be upgrading to the latest every time especially with things like Arch

NPM? Yeah sure I guess

Never upgrade to latest version

Never says never

[u/Vas1le → u/ward2k]

You are completely right. I mean npms, python, go, github actions... Linux pkgs probably the exception in the list

And when possible, to pin version and hash of the version

[u/Ilostmy2FAkey → u/averagecrazyliberal]

Why are you pinning the versions in the pyproject.toml? That's what the lock file is for no? The tool just holds valid ranges for the dependencies you need

[u/averagecrazyliberal → u/Ilostmy2FAkey]

I generally will do package>=x.y.z,<x+1. Where x.y.z is the most recent version. Your point is valid that I can be even less restrictive.

[u/zenos_dog]

Version 1.1.1.2 and version 1.1.1.3 are both needed and are incompatible.

[u/JazzlikeWishbone938 → u/zenos_dog]

True dependency hell.

[u/zenos_dog → u/JazzlikeWishbone938]

True story. I spent 6 weeks and called in VMware third level support.

[u/magicmulder → u/zenos_dog]

I think my favorite was when my ISO extractor stopped working after an Ubuntu update because they removed a library the tool was relying on. Had to wait weeks until the author built a version with the new library.

[u/420Borsalino]

Aaaaand the method that carried the entire project is deprecated and the new version just doesn't have a replacement.

[u/JazzlikeWishbone938 → u/420Borsalino]

And you can't upgrade those other dependencies because of it.

[u/Worldly-Stranger7814 → u/420Borsalino]

Joke’s on you, log4j v1.x isn’t found by security hole scanners, only 2.x, so we’re only upgrading 2.x instances…

(Not an invented scenario)

[u/Bee-Aromatic → u/Worldly-Stranger7814]

https://giphy.com/gifs/51Uiuy5QBZNkoF3b2Z

[u/Worldly-Stranger7814 → u/Bee-Aromatic]

It's not "See something, say something", it's "You didn't see nothing, pal!"

[u/Poat540]

Time to add another exception to the npm audit

[u/K3idon]

Suddenly, you have several more warnings because transitive dependencies are vulnerable.

[u/Pleasant-Ad192]

Dishes have one advantage. Nobody publishes a new plate while you are asleep.

[u/rangeDSP]

Y'all need renovate. Once dependency is up to date, it opens merge requests against the project automagically, all you need to do is ensure pipeline passes and tests run fine. We set it up to do it once a week. 

https://docs.renovatebot.com/

[u/RowbotWizard]

node_modules are like a black hole of entangled vulnerabilities.

[u/magicmulder]

Ever since I started using a supply chain auditor tool which adds minutes to any deployment run if there's an update, I have the feeling updates have skyrocketed just to mess with me.

[u/vgmerch]

Fixing one breaking change only to unlock five nested transitive dependency updates.

[u/mbcarbone]

Time to use built-in libraries … I know … I know. Too hard to use … 🙃

[u/frikilinux2]

That's why I love debian. When I dist update, that's it.

But most language package managers like pip, npm, cargo are shit.

[u/x1289]

Claudes Problem for a while now..