Use more conservative net-http version constraint#53
Conversation
Changes the net-http dependency from `>= 0.5.0` to `~> 0.5`. The previous constraint (`>= 0.5.0`) allowed any version upgrade, including major version bumps (e.g., 1.0.0, 2.0.0) which could introduce breaking changes. The new constraint `~> 0.5` allows flexibility across 0.x versions (0.5.x, 0.6.x, 0.7.x, etc.) while protecting against automatic upgrades to 1.0+ major versions. This provides a better balance between: - Flexibility for projects to choose their preferred 0.x version - Protection against major breaking changes in future releases This change helps prevent unexpected breaking changes from being automatically pulled into projects relying on faraday-net_http as a transitive dependency.
|
Some of the ruby core team feel that this kind of conservative gem versioning is a bad idea; see comments in: |
|
In this particular case, not only would the IMO, the best approach in this case would be to petition Tangentially, dependabot upgrading transitive dependencies without also collecting and reporting their release notes (changelog, commits, etc) is one of my biggest annoyances with it (that and the bug where it insists on converting emojis into shortcodes). I consider it a bug. I've seen dependabot upgrade rails as a transitive dependency for some development gem, without a word in the PR description. |
Summary
Changes the
net-httpdependency constraint from>= 0.5.0to~> 0.5to provide better protection against breaking changes in future major versions.Motivation
The current constraint
>= 0.5.0is very permissive, as it allows any version upgrade, including major version bumps (1.0.0, 2.0.0, etc.) which could introduce breaking changes.The new constraint
~> 0.5provides better protection while maintaining flexibility:Changes
This change was prompted by a recent incident with https://github.com/ruby/net-http/releases/tag/v0.7.0, which introduced a breaking change (removal of automatic
Content-Type: application/x-www-form-urlencodedheader for requests with a body) but was released as a minor version bump. Because of the permissive>= 0.5.0constraint infaraday-net_http, projects using it as a transitive dependency were automatically upgraded to this0.7.0version ofnet-httpduring unrelated dependency updates, causing unexpected production issues.1Further improvements
While
~> 0.5still allows 0.7.x (since it permits all 0.x versions), it provides protection against future major versions. If you'd prefer even stricter protection, we could consider~> 0.6instead, which would block 0.7+ entirely. However, this might be too restrictive for projects that have already upgraded tonet-http0.7.WDYT?
Footnotes
Of course, the reviewer is ultimately responsible for checking all changes in the PR, including transitive dependencies. That said, bumping minor versions when introducing breaking changes makes it more likely such updates go unnoticed, raising the risk of unexpected production issues that are then particularly difficult to trace. ↩