ecosyste-ms / ecosyste-ms/resolve

Ability to resolve dependencies "in the past"

Open
#212 11 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Ruby
Stars
7
Forks
1
PR merge metrics
No merged PRs in 30d

Description

Hello @andrew,

This endpoint is really useful to resolve dependencies based on the current situation of a package (i.e., based on the releases that are currently available). Would it be possible to add a "date" field to simulate dependency resolution for a specific date? To some extent, this means only considering releases of packages that were available up to the given date.

Consider the following example:
- Root package is "A" in version 1.0.0 (version is not important here), and has a dependency towards "B";
- Dependency constraint for "B" is `>=1.0.0`;
- On 23-07-12 (today), B has two releases: 1.0.0 released on 23-06-01 (last month), 1.0.1 released on 23-07-01 (12 days ago).

Currently, the endpoint would list "B@1.0.1" as a resolved dependency (as `1.0.1` is the latest/highest release satisfying the constraint). What we would like to do is, for example, to know what were the dependencies of A on 23-06-01. In this specific example, the endpoint would return "B@1.0.0" since `1.0.0` is the highest/latest release of B complying with given dependency constraint at that specific point in time (because `1.0.1` was not yet released at that date). So, with a very naive approach, given a `date` field, the process to resolve dependencies (and transitive dependencies) would consist of applying the current algorithm but only taking into account releases whose release date is `<= date`.

(Adding @hassanonsori since he's the one working on this currently ;-))

## Funding
* You can sponsor this specific effort via a [Polar.sh](https://polar.sh) pledge below
* We receive the pledge once the issue is completed & verified


Fund with Polar

Contributor guide

Open the contributing guide

Research direction

Start by tracing the endpoint's current dependency-resolution flow and how it selects package releases. Define the date input and verify that direct and transitive dependencies consider only releases available on or before that date, using the A/B example as the expected result.

Written by the indexing model from the issue text.

Assessment

Tech stack
ruby
Domain
api
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.