fsprojects / fsprojects/Paket

Can Paket generate a paket.lock file with only exact versions (to help with release stability)?

Open
#3,254 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
F#
Stars
2.1k
Forks
528
Avg merge
1d 12m
Merged PRs (30d)
54

Description

Description

Does Paket have a way to lock all packages (both direct & transitive dependencies) to exact versions, for the sake of preserving the stability of a release product? I have read the documentation for paket install, paket update, and paket.lock, and I can't find anything that would do this. The closest I can find is in the paket.lock documentation, which states the following:

Committing the paket.lock file to your version control system guarantees that other developers and/or build servers will always end up with a reliable and consistent set of packages regardless of where or when paket restore is executed.

I think that's only somewhat true. Consider the following situation:

Actual behavior
paket.lock
NUGET
  remote: https://api.nuget.org/v3/index.json
    PackA (1.0.0)
      PackB (>= 3.0.0)
  • PackB releases v3.4.0
  • I update my packages to the latest version
  • I release my product
  • PackB releases v4.0.0
  • I rebuild my product on a new machine, which now resolves to PackB 4.0.0

Note that this is a problem even when major versions aren't revved: a minor version could introduce a bug or inadvertently introduce a breaking change. The only correct thing here is to lock PackB to an exact version.

Expected behavior

It would be great if there were some way to tell Paket to generate a paket.lock file with exact versions for every package so that it is 100% stable over time.

paket.lock
NUGET
  remote: https://api.nuget.org/v3/index.json
    PackA (1.0.0)
      PackB (3.4.0)
  • PackB releases v3.4.0
  • I update my packages to the latest version
  • I lock down the paket.lock to exact versions
  • I release my product
  • PackB releases v4.0.0
  • I rebuild my product on a new machine, which still resolves to PackB 3.4.0

Maybe this could be done with a --release or --exact-versions flag on paket install.

Known workarounds

I'm not aware of any, which is why this is both a question and a request.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the paket install, paket update, and paket.lock documentation mentioned in the issue, then reproduce the PackA/PackB resolution scenario. Done means Paket can produce a lock file that keeps both direct and transitive package versions exact across later restores, with coverage for the shown case.

Written by the indexing model from the issue text.

Assessment

Domain
cli, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.