synapse/changelog.d/19829.doc at b2246de4e3752021071cb6bef66b80822f8f8dfd - synapse - Gitea: Git with a cup of tea

mirror of https://github.com/element-hq/synapse.git synced 2026-07-29 12:01:05 +00:00

Files

T

Olivier 'reivilibreandGitHub 1c79397d7f Tweak wording of Rust crate dependency update policy. (#19829 )

After looking into it, just a couple of things to pick a bone at in the
old wording,
which I thought could be clarified for when I next come to look at this
again.


- the claim that there's a fundamental difference; I'd argue there isn't
really, it's just by convention
  on some mainstream distros. So I have changed this to 'typically'
- statements that some distros fetch dependencies at build time
(probably does happen, but
traditional distros make a point of not doing this for the reasons you'd
expect).
- This was probably meant to be talking about Debian, but my observation
based on sample size of 3 is that some crates are packaged natively,
others are vendored in the respective application's source package (like
they do for us) and sometime they patch the bounds a bit

There could probably be room to talk about how distros vendoring
packages is a maintenance burden on them,
but I guess it's a bit moot as we would struggle to conform to wide
enough bounds to make everyone
happy (and anyway; I expect the distros that vendor packages have the
tooling to make this easy to
update and we do keep on top of security updates and release
frequently...)

---

Spawning from discussion in
[`#element-backend-internal:matrix.org`](https://matrix.to/#/!SGNQGPGUwtcPBUotTL:matrix.org/$VttYPPUevn2S_W_rrzg2ZOXWI6aKebk2ganTgrLEWUc?via=jki.re&via=element.io&via=matrix.org)

---------

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>

2026-06-23 18:40:38 +01:00

1 line

53 B

Plaintext

Raw Blame History

Tweak wording of Rust crate dependency update policy.