alt.hn

3/8/2026 at 11:27:49 AM

If It Quacks Like a Package Manager

https://nesbitt.io/2026/03/08/if-it-quacks-like-a-package-manager.html

by jandeboevrie

3/8/2026 at 6:35:43 PM

On an aside, the MVS (minimum version selection) is an interesting and understandable algorithm for dependency resolution. Started from Go, CUE uses it now too.

https://research.swtch.com/vgo-mvs

by verdverm

3/9/2026 at 4:17:21 AM

It's wild to me that MVS didn't get picked up everywhere else for their next-gen package managers. Picking up "fixes" automatically turned out to be a boondoggle, if not a security risk. There's no reason we need to write a SAT solver just to manage our library dependencies.

by amazingman

3/8/2026 at 4:31:47 PM

> If it has transitive execution, it’s a package manager

Not really.

Spreadsheets, programming language functions, database triggers.

To be more accurate, if it downloads artifacts transitively it is a package manager.

by paulddraper

3/8/2026 at 6:05:33 PM

Not really, it's not about downloading. If it only works offline given the appropriate files, that's fine too. But a package manager needs to actually install and uninstall packages!

by dataflow

3/8/2026 at 5:22:24 PM

I could see a case being made that programming language functions, especially in ruby where everything is message passing, forms a package manager. A method might actually want to guarantee that when it sends a message foo that the code receiving it remains fixed.

Being able to declare dependencies that granular might actually be great for doing refactors and upgrades. Maybe we accepted too easily that dependencies for a project are global.

by Spivak

3/9/2026 at 1:15:26 AM

in raku, versions are specified for imported packages, not for installed packages; you can specify in the code a dependency on a particular version

by nagaiaida

3/8/2026 at 6:32:52 PM

We sort of do by bundling them up and pinning them together at some version id.

by verdverm