{"action":"created","issue":{"url":"https://api.github.com/repos/sourcegraph/lsp-adapter/issues/72","repository_url":"https://api.github.com/repos/sourcegraph/lsp-adapter","labels_url":"https://api.github.com/repos/sourcegraph/lsp-adapter/issues/72/labels{/name}","comments_url":"https://api.github.com/repos/sourcegraph/lsp-adapter/issues/72/comments","events_url":"https://api.github.com/repos/sourcegraph/lsp-adapter/issues/72/events","html_url":"https://github.com/sourcegraph/lsp-adapter/issues/72","id":326668968,"node_id":"MDU6SXNzdWUzMjY2Njg5Njg=","number":72,"title":"Should we pin OS packages in the Dockerfiles?","user":{"login":"chrismwendt","id":1387653,"node_id":"MDQ6VXNlcjEzODc2NTM=","avatar_url":"https://avatars0.githubusercontent.com/u/1387653?v=4","gravatar_id":"","url":"https://api.github.com/users/chrismwendt","html_url":"https://github.com/chrismwendt","followers_url":"https://api.github.com/users/chrismwendt/followers","following_url":"https://api.github.com/users/chrismwendt/following{/other_user}","gists_url":"https://api.github.com/users/chrismwendt/gists{/gist_id}","starred_url":"https://api.github.com/users/chrismwendt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrismwendt/subscriptions","organizations_url":"https://api.github.com/users/chrismwendt/orgs","repos_url":"https://api.github.com/users/chrismwendt/repos","events_url":"https://api.github.com/users/chrismwendt/events{/privacy}","received_events_url":"https://api.github.com/users/chrismwendt/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-05-25T21:27:26Z","updated_at":"2018-06-13T23:13:26Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Ubuntu recently released a new security patch for curl and removed the old package that we were depending on, and the quickest fix was to bump the version in #71.\r\n\r\nWe can continue to bump the versions as we notice builds failing, or we could unpin all the versions and trust that Ubuntu, for example, won't introduce breaking changes."},"comment":{"url":"https://api.github.com/repos/sourcegraph/lsp-adapter/issues/comments/397117077","html_url":"https://github.com/sourcegraph/lsp-adapter/issues/72#issuecomment-397117077","issue_url":"https://api.github.com/repos/sourcegraph/lsp-adapter/issues/72","id":397117077,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NzExNzA3Nw==","user":{"login":"felixfbecker","id":10532611,"node_id":"MDQ6VXNlcjEwNTMyNjEx","avatar_url":"https://avatars0.githubusercontent.com/u/10532611?v=4","gravatar_id":"","url":"https://api.github.com/users/felixfbecker","html_url":"https://github.com/felixfbecker","followers_url":"https://api.github.com/users/felixfbecker/followers","following_url":"https://api.github.com/users/felixfbecker/following{/other_user}","gists_url":"https://api.github.com/users/felixfbecker/gists{/gist_id}","starred_url":"https://api.github.com/users/felixfbecker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/felixfbecker/subscriptions","organizations_url":"https://api.github.com/users/felixfbecker/orgs","repos_url":"https://api.github.com/users/felixfbecker/repos","events_url":"https://api.github.com/users/felixfbecker/events{/privacy}","received_events_url":"https://api.github.com/users/felixfbecker/received_events","type":"User","site_admin":false},"created_at":"2018-06-13T23:13:26Z","updated_at":"2018-06-13T23:13:26Z","author_association":"MEMBER","body":"@chrismwendt moving this here\r\n\r\nLets compare:\r\nThe obvious downsides of pinning are\r\n- We constantly need to update the versions\r\n- Old builds or commits can never be rebuilt (locally nor in CI) because packages don't exist anymore. This strictly worse than having them _potentially_ not possible to rebuild because of a breaking change (potentially vs guaranteed).\r\n\r\nWhat _benefits_ does it have for us to pin them? (I see none)"}}
{"actor":{"display_login":"felixfbecker"}}