The PVP ought to mention dependency bounds (Was: Growing Haskell Platform)

[Ian Lynagh]

On Mon, Dec 10, 2012 at 12:15:47PM +0800, Conrad Parker wrote:
> On 8 December 2012 00:41, Ian Lynagh <ian at well-typed.com> wrote:
> > On Fri, Dec 07, 2012 at 08:30:45AM -0800, Johan Tibell wrote:
> >> On Fri, Dec 7, 2012 at 8:28 AM, Ian Lynagh <ian at well-typed.com> wrote:
> >> > On Fri, Dec 07, 2012 at 08:20:41AM -0800, Johan Tibell wrote:
> >> >>
> >> >> If B only bumps its patch-level version (i.e. to B-1.0.0.1), C no
> >> >> longer compiles (due to a version constraint failure) with B-1.0.0.1
> >> >
> >> > Won't cabal-install select B-1.0 in that case, so installing C will
> >> > still work?
> >>
> >> See my aside at the end. Yes, it will backtrack and use the older
> >> version, but the users might get confused why the new version isn't
> >> used as it's version number suggests that it could be.
> >
> > I don't think most users would notice, and for those that do the "-v"
> > flag to cabal-install ought to tell them why.
> >
> > I don't think this (theoretical?) confusion issue is worth the effort of
> > bumping major versions all the way up the dependency tree.
> 
> What if the minor version bump in B is for fixing a security issue?

Then the proposal doesn't help: It doesn't matter whether you give the
new version of B a version number of 1.0.0.1 or 2.0.0.0, cabal-install
will still install B 1.0 and A 1.0 when asked to install C.


Thanks
Ian