carton fails to update dependencies when the versions in the carton.lock change about carton

[miyagawa]

Updating versions in a dependency tree is a known todo item.

[miyagawa]

Same as #3.

[wchristian]

Alright, would you be willing to discuss this a bit more?

As i will need to have this functionality working i'm also willing to implement what is necessary. However from looking at https://github.com/miyagawa/carton/blob/master/lib/Carton.pm#L36 it is not quote obvious why only the first children from the tree are retrieved instead of all leaves. Why is that?

[miyagawa]

Because the tree is built by analyzing the dependencies, picking up first children is enough to pull up everything.

Version changes in the middle of tree is a separate problem - because Perl projects can't depend on multiple versions of the same module, the only solution is to depend on (and lock) the higher version. The correct approach here is to implement a command to update a locked version of a module, and also prompts you to do that if one of the new dependency you added requires a newer version of the module.

Current workaround for this is to remove carton.lock and local directory, and rerun the whole build process, which will pull the newer version of the module from CPAN.

[wchristian]

Ok, so what's really missing as a first step then is the possibility to interactively update one of the locked modules, possibly by showing the user all the modules depending on it; as well as catching installs of modules that are already in carton.lock and redirecting such attempts to update.

After that a deploy install can actually go and entirely rely on the contents of carton.lock because it knows they're all meant that way.

That about right?

[miyagawa]

i am not sure about the interactive-ness. It should catch the update of locked modules, whether it is given from a command line or as a dependency, and replace the version to the later one that satisfies the requirement, rather than adding multiple versions in the tree. I actually think the default is just go ahead and update to the newer version without prompts, unless it's told not to, since the CPAN's policy is that the latest version is always the best.

Ruby's bundler can do this better by specifying the version range (with ~>) and detect conflicts too. Perl's meta spec also have the range ability but afaik nobody uses it correctly.

[wchristian]

I was hoping i'd get at least some answer, but you apparently don't want to answer on irc, so maybe here: The update function, are you thinking of updating all the things to latest, only the given module to latest, or given module to given version?

Also, on rereading I realize i do not understand this bit:

picking up first children is enough to pull up everything.

When i do carton install i expect carton to install exactly what is inside the carton.lock file. However right now it does not do that and only does a half job, making it possible for modules i explicitly declared as a dependency to be installed in newer versions than what i declared, or changes in my declarations to be ignored.

This could easily be resolved by making carton install modules by walking up the tree from the tips of branches and installing exactly what the tree demands. I don't understand what that has to do with the lack or presence of an update feature.

[miyagawa]

The update function, are you thinking of updating all the things to latest, only the given module to latest, or given module to given version?

carton update will update all the dependencies to the latest, and carton update Foo will update Foo to the latest.

You don't need to specify version from the command line, since the version upper limit should be specified in the makefile or cpanfile using the Version range syntax.

When i do carton install i expect carton to install exactly what is inside the carton.lock file. However right now it does not do that and only does a half job, making it possible for modules i explicitly declared as a dependency to be installed in newer versions than what i declared, or changes in my declarations to be ignored.

If you run carton install --deployment it should not happen since the 02packages file are recreated based on the lock file. Maybe carton install should do the same thing.

[miyagawa]

Duplicate of problems mentioned in other issues.

[KES777]

carton update will update all the dependencies

Carton update do not update all the dependencies. It update only modules mentioned at cpanfile

$ carton update
Net::IP is up to date. (1.26)
Net::DNS is up to date. (1.15)
DBD::Pg is up to date. (3.7.4)
Modern::Perl is up to date. (1.20170117)
JSON::XS is up to date. (3.04)
Data::Printer is up to date. (0.40)
Array::Set is up to date. (0.05)
Email::Sender::Transport::SMTPS is up to date. (0.04)
Successfully installed DateTime-1.48 (upgraded from 1.46)
Test::Mojo::WithRoles is up to date. (0.02)
Successfully installed CryptX-0.060 (upgraded from 0.057)
Log::Log4perl is up to date. (1.49)
Array::Diff is up to date. (0.07)
Mojolicious is up to date. (7.71)
String::CamelCase is up to date. (0.04)
DBIx::Class::InflateColumn::Serializer is up to date. (0.09)
Net::SSLeay is up to date. (1.80)
Business::MaxMind::CreditCardFraudDetection is up to date. (1.60)
Lingua::EN::Inflect is up to date. (1.903)
Successfully installed String-ShellQuote-1.04
Successfully installed CPAN-Meta-Check-0.014
Successfully installed IPC-Run3-0.048
Successfully installed HTTP-Tinyish-0.14
Successfully installed Win32-ShellQuote-0.003001
Successfully installed local-lib-2.000024
Successfully installed File-pushd-1.014
Successfully installed ExtUtils-MakeMaker-CPANfile-0.08
Successfully installed Parse-PMFile-0.41
Successfully installed CPAN-DistnameInfo-0.12
Successfully installed Tie-Handle-Offset-0.004
Successfully installed CPAN-Common-Index-0.010
Successfully installed Menlo-1.9019
Successfully installed Menlo-Legacy-1.9021
Successfully installed Carton-v1.0.33 (upgraded from v1.0.28)
Mojolicious::Plugin::TagHelpers::Pagination is up to date. (0.06)
Successfully installed XML-Simple-2.25 (upgraded from 2.24)
Net::Domain::TLD is up to date. (1.75)
Successfully installed MaxMind-DB-Reader-XS-1.000005 (upgraded from 1.000004)
Net::Subnet is up to date. (1.03)
Successfully installed Number-Phone-3.4004 (upgraded from 3.4003)
Successfully installed GeoIP2-2.005001 (upgraded from 2.005000)
Email::Valid is up to date. (1.202)
DBIx::Class::DeploymentHandler is up to date. (0.002222)
Mojolicious::Plugin::Scrypt is up to date. (0.01)
DBIx::Class::Migration is up to date. (0.060)
DateTime::Format::Pg is up to date. (0.16013)
Module::Install is up to date. (1.19)
21 distributions installed

$ carton update 
Business::MaxMind::CreditCardFraudDetection is up to date. (1.60)
Array::Diff is up to date. (0.07)
Net::Domain::TLD is up to date. (1.75)
MaxMind::DB::Reader::XS is up to date. (1.000005)
Module::Install is up to date. (1.19)
DBIx::Class::DeploymentHandler is up to date. (0.002222)
Net::IP is up to date. (1.26)
DBD::Pg is up to date. (3.7.4)
Net::SSLeay is up to date. (1.80)
Carton is up to date. (v1.0.33)
Test::Mojo::WithRoles is up to date. (0.02)
DBIx::Class::Migration is up to date. (0.060)
XML::Simple is up to date. (2.25)
Lingua::EN::Inflect is up to date. (1.903)
Mojolicious is up to date. (7.71)
Net::DNS is up to date. (1.15)
Net::Subnet is up to date. (1.03)
Modern::Perl is up to date. (1.20170117)
Mojolicious::Plugin::TagHelpers::Pagination is up to date. (0.06)
Email::Valid is up to date. (1.202)
Crypt::PRNG is up to date. (0.060)
Number::Phone is up to date. (3.4004)
GeoIP2::Database::Reader is up to date. (2.005001)
Log::Log4perl is up to date. (1.49)
Email::Sender::Transport::SMTPS is up to date. (0.04)
Data::Printer is up to date. (0.40)
Array::Set is up to date. (0.05)
DateTime is up to date. (1.48)
DateTime::Format::Pg is up to date. (0.16013)
JSON::XS is up to date. (3.04)
String::CamelCase is up to date. (0.04)
Mojolicious::Plugin::Scrypt is up to date. (0.01)
DBIx::Class::InflateColumn::Serializer is up to date. (0.09)

cpanfile.txt
snapshot before update:
cpanfile.snapshot.txt

snapshot after update:
cpanfile.snapshot.txt

As you can see it did not update List-MoreUtils-0.416 despite on 0.428 is available

[KES777]

Will it be applicable to implement --all option?

carton update --all

[KES777]

carton update will update all the dependencies to the latest, and carton update Foo will update Foo to the latest.

But next fails:

$ carton update List::MoreUtils
Use of uninitialized value in concatenation (.) or string at /home/kes/perl5/perlbrew/perls/perl-5.24.0/lib/site_perl/5.24.0/Carton/CLI.pm line 346.
! Couldn't find module or a distribution List::MoreUtils~
Updating modules failed