Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.programming > #4136 > unrolled thread

How to track an updates to a 3party libraries?

Back to article view | Back to comp.programming

Contents

  How to track an updates to a 3party libraries? Alexander Artemenko <svetlyak.40wt@gmail.com> - 2014-03-17 00:12 -0700
    Re: How to track an updates to a 3party libraries? Öö Tiib <ootiib@hot.ee> - 2014-03-17 05:42 -0700
      Re: How to track an updates to a 3party libraries? Alexander Artemenko <svetlyak.40wt@gmail.com> - 2014-03-17 23:52 -0700
        Re: How to track an updates to a 3party libraries? Öö Tiib <ootiib@hot.ee> - 2014-03-18 10:13 -0700

#4136 — How to track an updates to a 3party libraries?

As a software developer, I use many 3-party libraries in my daily job. Mostly, they are python libraries, but I think this theme should be language agnostic.

In python, we could store project's dependencies in different ways. They could be stated in the setup.py file or in pip's requirements.txt file. Some programmers prefer to pin exact version numbers some are not. I'm belonging to the first group.

Although pinning exact version numbers keeps me from accidental update to a backward incompatible versions, it also keeps me from updating (and more importantly from discovering) to a bug/security fixes, introduced in these new versions.

What do you use to follow 3-party libraries updates? How to solve this problem and keep on a bleeding edge?

[toc] | [next] | [standalone]

#4137

On Monday, 17 March 2014 09:12:31 UTC+2, Alexander Artemenko  wrote:
> As a software developer, I use many 3-party libraries in my daily job. Mostly, they are 
> python libraries, but I think this theme should be language agnostic.
> 
> In python, we could store project's dependencies in different ways. They could be stated in
> the setup.py file or in pip's requirements.txt file. Some programmers prefer to pin exact
> version numbers some are not. I'm belonging to the first group.
> 
> Although pinning exact version numbers keeps me from accidental update to a 
> backward incompatible versions, it also keeps me from updating (and more importantly 
> from discovering) to a bug/security fixes, introduced in these new versions.

Majority of library designers follow certain policy in version numbering. They claim
it openly. For example Apache https://apr.apache.org/versioning.html and so on.
If there is such a policy in place then you can easily decide likely compatibility based
on version numbers. 

Only few do not follow such policies strictly enough. If it is case then that means more
work for you. You have to try and retest the backward compatibility of newer versions
of such  libraries for your particular case yourself. If possible automate that and keep 
fresh list of compatible versions with your product.

> What do you use to follow 3-party libraries updates? How to solve this problem and
> keep on a bleeding edge?

Upgrade to bleeding edge library only when it certainly contains features or performance
improvements that greatly benefit your product. It is rarely the case; newer major versions
more often tend to add bloat "convenience" features, sometimes replace useful features
with less useful ones and only very rarely add something innovative that you need. 

[toc] | [prev] | [next] | [standalone]

#4143

Öö, you did not answer the main question. What is there a way to automate tracking of really critical bug-fixes?

понедельник, 17 марта 2014 г., 16:42:18 UTC+4 пользователь Öö Tiib написал:
> On Monday, 17 March 2014 09:12:31 UTC+2, Alexander Artemenko  wrote:
> 
> > As a software developer, I use many 3-party libraries in my daily job. Mostly, they are 
> 
> > python libraries, but I think this theme should be language agnostic.
> 
> > 
> 
> > In python, we could store project's dependencies in different ways. They could be stated in
> 
> > the setup.py file or in pip's requirements.txt file. Some programmers prefer to pin exact
> 
> > version numbers some are not. I'm belonging to the first group.
> 
> > 
> 
> > Although pinning exact version numbers keeps me from accidental update to a 
> 
> > backward incompatible versions, it also keeps me from updating (and more importantly 
> 
> > from discovering) to a bug/security fixes, introduced in these new versions.
> 
> 
> 
> Majority of library designers follow certain policy in version numbering. They claim
> 
> it openly. For example Apache https://apr.apache.org/versioning.html and so on.
> 
> If there is such a policy in place then you can easily decide likely compatibility based
> 
> on version numbers. 
> 
> 
> 
> Only few do not follow such policies strictly enough. If it is case then that means more
> 
> work for you. You have to try and retest the backward compatibility of newer versions
> 
> of such  libraries for your particular case yourself. If possible automate that and keep 
> 
> fresh list of compatible versions with your product.
> 
> 
> 
> > What do you use to follow 3-party libraries updates? How to solve this problem and
> 
> > keep on a bleeding edge?
> 
> 
> 
> Upgrade to bleeding edge library only when it certainly contains features or performance
> 
> improvements that greatly benefit your product. It is rarely the case; newer major versions
> 
> more often tend to add bloat "convenience" features, sometimes replace useful features
> 
> with less useful ones and only very rarely add something innovative that you need.

[toc] | [prev] | [next] | [standalone]

#4144

On Tuesday, 18 March 2014 08:52:30 UTC+2, Alexander Artemenko  wrote:
> понедельник, 17 марта 2014 г., 16:42:18 UTC+4 пользователь Öö Tiib написал:
> > On Monday, 17 March 2014 09:12:31 UTC+2, Alexander Artemenko  wrote:
> > > As a software developer, I use many 3-party libraries in my daily job. Mostly, they are 
> > > python libraries, but I think this theme should be language agnostic.
> > > In python, we could store project's dependencies in different ways. They could be stated in
> > > the setup.py file or in pip's requirements.txt file. Some programmers prefer to pin exact
> > > version numbers some are not. I'm belonging to the first group.
> > > 
> > > Although pinning exact version numbers keeps me from accidental update to a 
> > > backward incompatible versions, it also keeps me from updating (and more importantly 
> > > from discovering) to a bug/security fixes, introduced in these new versions.
> > 
> > Majority of library designers follow certain policy in version numbering. They claim
> > it openly. For example Apache https://apr.apache.org/versioning.html and so on.
> > If there is such a policy in place then you can easily decide likely compatibility based
> > on version numbers. 
> > 
> > Only few do not follow such policies strictly enough. If it is case then that means more
> > work for you. You have to try and retest the backward compatibility of newer versions
> > of such  libraries for your particular case yourself. If possible automate that and keep 
> > fresh list of compatible versions with your product.
> > 
> > > What do you use to follow 3-party libraries updates? How to solve this problem and
> > > keep on a bleeding edge?
> > 
> > Upgrade to bleeding edge library only when it certainly contains features or performance
> > improvements that greatly benefit your product. It is rarely the case; newer major versions
> > more often tend to add bloat "convenience" features, sometimes replace useful features
> > with less useful ones and only very rarely add something innovative that you need.
> 
> Öö, you did not answer the main question. What is there a way to automate tracking of 
> really critical bug-fixes?

The answer was that if there is a policy in place that makes something to indicate
in machine-detectable form something about new version available then you can
automate (at least some part of) its tracking. For that one has to read policies of
particular library authors.

It can be a public web service, special announcement post in some mailing list, 
well-structured product notes or just clever way to version number. For example
you want to know what is current version of Java available. You make service that
checks it from: http://java.com/applet/JreCurrentVersion2.txt

If there are no such things in place then you have to use human work-power for
tracking and figuring situation out. I am not sure ... what part I did not answer?

[toc] | [prev] | [standalone]

Back to top | Article view | comp.programming

csiph-web