{"action":"created","issue":{"url":"https://api.github.com/repos/bower/bower/issues/2371","repository_url":"https://api.github.com/repos/bower/bower","labels_url":"https://api.github.com/repos/bower/bower/issues/2371/labels{/name}","comments_url":"https://api.github.com/repos/bower/bower/issues/2371/comments","events_url":"https://api.github.com/repos/bower/bower/issues/2371/events","html_url":"https://github.com/bower/bower/pull/2371","id":180195801,"number":2371,"title":"Prefer exact versions when dissecting dependencies","user":{"login":"eugeneius","id":432189,"avatar_url":"https://avatars.githubusercontent.com/u/432189?v=3","gravatar_id":"","url":"https://api.github.com/users/eugeneius","html_url":"https://github.com/eugeneius","followers_url":"https://api.github.com/users/eugeneius/followers","following_url":"https://api.github.com/users/eugeneius/following{/other_user}","gists_url":"https://api.github.com/users/eugeneius/gists{/gist_id}","starred_url":"https://api.github.com/users/eugeneius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eugeneius/subscriptions","organizations_url":"https://api.github.com/users/eugeneius/orgs","repos_url":"https://api.github.com/users/eugeneius/repos","events_url":"https://api.github.com/users/eugeneius/events{/privacy}","received_events_url":"https://api.github.com/users/eugeneius/received_events","type":"User","site_admin":false},"labels":[{"id":476507221,"url":"https://api.github.com/repos/bower/bower/labels/breaking%20change","name":"breaking change","color":"e99695","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-30T00:37:52Z","updated_at":"2016-11-08T00:41:47Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/bower/bower/pulls/2371","html_url":"https://github.com/bower/bower/pull/2371","diff_url":"https://github.com/bower/bower/pull/2371.diff","patch_url":"https://github.com/bower/bower/pull/2371.patch"},"body":"When a project has multiple dependencies on the same package, we try to find one that resolves to a version that also satisfies all of the other constraints. Dependencies are checked in the order that they were resolved, which is dependent on network latency and essentially random. If there are multiple valid resolutions, running `bower install` with the same `bower.json` file won't always produce the same result, which can lead to inconsistent behaviour across environments.\n\nIf one of the dependencies specifies an exact version, we should prefer it over others that specify a range of versions. This is consistent with how we already deprioritise wildcard targets - we want to choose the most specific target of the highest version which resolves correctly.\n"},"comment":{"url":"https://api.github.com/repos/bower/bower/issues/comments/259010372","html_url":"https://github.com/bower/bower/pull/2371#issuecomment-259010372","issue_url":"https://api.github.com/repos/bower/bower/issues/2371","id":259010372,"user":{"login":"eugeneius","id":432189,"avatar_url":"https://avatars.githubusercontent.com/u/432189?v=3","gravatar_id":"","url":"https://api.github.com/users/eugeneius","html_url":"https://github.com/eugeneius","followers_url":"https://api.github.com/users/eugeneius/followers","following_url":"https://api.github.com/users/eugeneius/following{/other_user}","gists_url":"https://api.github.com/users/eugeneius/gists{/gist_id}","starred_url":"https://api.github.com/users/eugeneius/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eugeneius/subscriptions","organizations_url":"https://api.github.com/users/eugeneius/orgs","repos_url":"https://api.github.com/users/eugeneius/repos","events_url":"https://api.github.com/users/eugeneius/events{/privacy}","received_events_url":"https://api.github.com/users/eugeneius/received_events","type":"User","site_admin":false},"created_at":"2016-11-08T00:41:47Z","updated_at":"2016-11-08T00:41:47Z","body":"I'll happily add a flag for this if it means it can ship in a minor release.\r\n\r\nHowever I'm not sure how it could be considered a breaking change - it takes something that is currently random and makes it deterministic. You might get this behaviour right now, or you might get different (and IMO totally broken) behaviour. Even if you prefer the other behaviour, you have no way of making sure you get it reliably.\r\n\r\nHere's the actual situation that led to me writing this patch, which should hopefully illustrate why it's fixing a bug rather than changing behaviour:\r\n\r\n - We have an Ember application that specifies a dependency on `ember#2.7.0` in `bower.json`. It also depends on `ember-cli-shims`, which [transitively depends on `ember#>=1.4`](https://github.com/ember-cli/ember-cli-shims/blob/v0.1.1/bower.json#L21).\r\n - When our CI server runs `bower install`, both `ember#2.7.0` and `ember#>=1.4` resolve to `ember#2.7.0`. Since either resolved version satisfies both constraints, `ember>=1.4` is chosen at random. This constraint is written to `bower_components/ember/.bower.json` under the `_target` key.\r\n - Some time later, a new version of Ember is released, and an engineer bumps the dependency in `bower.json` to `ember#2.8.0`.\r\n - The CI server runs `bower install` again, which checks whether the target stored in `bower_components/ember/.bower.json`, which is `ember#>=1.4`, satisfies the dependency declared in `bower.json`, which is `ember#2.8.0`. It does, so Bower doesn't do anything.\r\n - We have a dependency on `ember#2.8.0` declared in `bower.json`, we ran `bower install`, but the installed version is still `ember#2.7.0`. This is broken!\r\n\r\nWith this patch, the `_target` key in `bower_components/ember/.bower.json` would always be set to `ember#2.7.0`, so Bower would have correctly installed the newer version of the package."}}
{"actor":{"display_login":"eugeneius"}}