Can Paket generate a paket.lock file with only exact versions (to help with release stability)?
Nobody has claimed this yet.
- Dominant language
- F#
- Stars
- 2.1k
- Forks
- 528
- Avg merge
- 1d 12m
- Merged PRs (30d)
- 54
Description
Description
Does Paket have a way to lock all packages (both direct & transitive dependencies) to exact versions, for the sake of preserving the stability of a release product? I have read the documentation for paket install, paket update, and paket.lock, and I can't find anything that would do this. The closest I can find is in the paket.lock documentation, which states the following:
Committing the paket.lock file to your version control system guarantees that other developers and/or build servers will always end up with a reliable and consistent set of packages regardless of where or when paket restore is executed.
I think that's only somewhat true. Consider the following situation:
Actual behavior
paket.lock
NUGET
remote: https://api.nuget.org/v3/index.json
PackA (1.0.0)
PackB (>= 3.0.0)
- PackB releases v3.4.0
- I update my packages to the latest version
- I release my product
- PackB releases v4.0.0
- I rebuild my product on a new machine, which now resolves to PackB 4.0.0
Note that this is a problem even when major versions aren't revved: a minor version could introduce a bug or inadvertently introduce a breaking change. The only correct thing here is to lock PackB to an exact version.
Expected behavior
It would be great if there were some way to tell Paket to generate a paket.lock file with exact versions for every package so that it is 100% stable over time.
paket.lock
NUGET
remote: https://api.nuget.org/v3/index.json
PackA (1.0.0)
PackB (3.4.0)
- PackB releases v3.4.0
- I update my packages to the latest version
- I lock down the paket.lock to exact versions
- I release my product
- PackB releases v4.0.0
- I rebuild my product on a new machine, which still resolves to PackB 3.4.0
Maybe this could be done with a --release or --exact-versions flag on paket install.
Known workarounds
I'm not aware of any, which is why this is both a question and a request.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the paket install, paket update, and paket.lock documentation mentioned in the issue, then reproduce the PackA/PackB resolution scenario. Done means Paket can produce a lock file that keeps both direct and transitive package versions exact across later restores, with coverage for the shown case.
Written by the indexing model from the issue text.
Assessment
- Domain
- cli, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100