We shouldn’t have needed lockfiles
Imagine you’re writing a project and need a library. Let’s call it libpupa .
You look up its current version, which is 1.2.3 , and add it to your dependencies:
"libpupa": "1.2.3"
In turn, the developer of libpupa , when writing its version 1.2.3 , needed another library: liblupa .
So they did the same thing: they looked up the version, which was 0.7.8 at the time, and added it to the dependencies of libpupa 1.2.3 :
"liblupa": "0.7.8"
The version 0.7.8 of liblupa is immortalized forever in the dependencies of libpupa 1.2.3 . No matter how many other versions of either liblupa or libpupa are released, libpupa 1.2.3 will always depend on liblupa 0.7.8 .
Our dependency resolution algorithm thus is like this:
Get the top-level dependency versions
... continue reading