PyTorch and the PyPI supply chain [LWN.net]

PyTorch and the PyPI supply chain

Posted Jan 16, 2023 10:05 UTC (Mon) by kleptog (subscriber, #1183)
In reply to: PyTorch and the PyPI supply chain by rgmoore
Parent article: PyTorch and the PyPI supply chain

> Maybe this is unfair, but the impression I've gotten from the discussions on here is that anything less than full speed ahead will upset a lot of developers.

I read that here a lot too, but I've yet to meet such a developer in real life. Sure, you have junior developers that wonder what the point is. When they've spent a week trying to untangle dependencies to get the buildbot to pass again they suddenly appreciate the virtue of pinning versions.

Untangling package dependencies to find a working combination is one of the least interesting jobs there is.

to post comments

PyTorch and the PyPI supply chain

Posted Jan 16, 2023 11:37 UTC (Mon) by farnz (subscriber, #17727) [Link]

The thing that appears as "full speed ahead" is not that all developers want to be on the latest version of everything, but that the combined effect of all developers wanting their pet dependency to be on the latest version (which adds a feature they need, or a bugfix that affects their product's security) is "full speed ahead".

Basically, anything other than "we only accept dependencies in the oldest distribution release in extended support" (RHEL6, for example) ends up looking like "full speed ahead" in discussions, because no matter how carefully you consider your update plans, there will be someone who perceives your decision to update a minimum supported dependency version as "moving too fast".