Notify of new major versions available when running gleam update

[hayleigh-dot-dev]

As the ecosystem grows it is becoming more difficult to keep track of when packages are updated with new breaking changes. Short of just making a list of every dependency of every package I maintain and regularly checking for new versions, there is no real way to know if any of my dependencies have updated until a user opens an issue or I notice by happenstance.

One thing I can do reliably is run gleam update in my packages from time to time. I'd like to propose that command also reports when any major version bumps are available, something like:

 % gleam deps update
  Resolving versions
Downloading packages
 Downloaded 2 packages in 0.01s
 
Hint: the following dependencies have new major versions available...

- wibble@2
- wobble@3

I think this would have a general benefit to the community:

• package consumers get notified when things have moved on and can make an informed decision to upgrade or not.
• package authors have an easier time broadcasting new changes, which is particularly impactful for "foundation" packages like mist or lustre where the community at large benefits from being on the same version.
• package authors can more-easily make sure they're not fragmenting the community by sticking on old versions of dependencies unnecessarily.

[joshi-monster]

I hit this problem a few days ago. If I remember correctly,glisten and mist got into 2 incompatible versions after running gleam update, and I had to know that I had to manually update mist to ~>3 to resolve that; as far as I can tell there is no way right now to discover these new versions, except to manually check each of them on hex.

I decided then that my problem was a duplicate of #2583

Update - I reconstructed what happened:

• gleam_stdlib updated to a version where dynamic.unsafe_coerce was removed
• glisten could not be updated to a new version that didn't use that because mist depended on it
• gleam update would not update mist from v2 to v3, but only v3 depends on a version of glisten that is compatible with current stdlib.

[andho]

Shouldn't breaking upgrades (major versions) be held off if dependencies depend on an older version. Problem here is that gleam_stdlib doesn't have a stable api, and will break with minor versions. In this specific case mist update might solve it, but mist upgrade is orthogonal to the change in stdlib as far as semver is concerned.

[joshi-monster]

The point is that there is no way to discover these updates. If the new set of dependencies is solvable is not related to that. The stdlib being < 1.0 is kind of a special case, but also not related to that.

[richard-viney]

What are your thoughts on the following?

• A new gleam outdated command similar to npm outdated or yarn outdated which lists all dependencies that aren't at the latest version.
• A new gleam update --latest flag that updates packages to the latest version, regardless of their current version range constraint, and updates gleam.toml.
• A new gleam update --interactive flag that can be combined with --latest and works similarly to yarn upgrade-interactive --latest where you are prompted about whether to apply each available package version update.

[andho]

I looked at the mix deps.outdated and it's even better than npm and yarn. Definitely something we should have in gleam.

[richard-viney]

Can you describe what it does better?

[andho]

Well I shouldn't have said better. But it's the diff feature which seems very nice and important. See this article for details: https://blog.appsignal.com/2022/03/15/a-guide-to-secure-elixir-package-updates.html.

That being said, yarn and npm show both possible major and minor versions which is very nice.

[lpil]

@richard-viney we will never ignore the constraints specified in the package gleam.toml. If the programmer doesn't like the constraints they have specified then they can edit their constraints.

An interactive mode would be a lot of work for little value, so it would not be planned until higher value work is completed.