versionable dependencies

[jhheider]

we've discussed this numerous times, and it makes the dependency solver deeply non-trivial; that said, it does come up in multiple packages:

• deno.land requires variable rust versions to build depending on the deno version: https://github.com/pkgxdev/pantry/blob/6f7d86673e8c061f119294ca9307c275e9aef860/projects/deno.land/package.yml#L28-L40 ¹
• gnupg <2.5 depends on libassuan^2, while 2.5.0 depends on libassuan^3: ❌ build issues: gnupg.org=2.5.0 pantry#6640 ²
• facebook libraries generally all require being kept in version lockstep³

designing a syntax is the easy part; allowing the solver to work with it is much harder. this is a placeholder until we get there.

Footnotes

1. e.g.: dependencies: rust-lang.org: { '>=1.38<1.40': ^1.56, '<1.38': ~1.38, '>=1.40': ^1.80 } ↩

2. dependencies: gnupg.org/libassuan: { '>=2<2.50': ^2, '^2.5': ^3 } ↩

3. dependencies: facebook.com/fizz: version # match version exactly ↩

[mxcl]

I kinda feel like the facebook libraries should all be a single package since they don’t work independently.

[jhheider]

it's very possible, except that they don't need to be used together. and some, like watchman, release every week even if their own CI doesn't build a release cleanly (as it hasn't since spring). it's not a great system and their complete unwillingness to maintain the API between weeks is what causes issues.