Lost in Zero Space
summary
Analyzes package-manager metadata from npm, Cargo, Packagist and RubyGems (1.5M packages, 12M releases, 56M dependencies) to measure how often projects depend on 0.y.z versions, whether packages in major version zero later reach 1.0.0, and whether package managers’ policies correlate with packages getting “stuck” in zero. Uses dependency version-constraint analysis to check prevalence of 0.y.z dependencies, reluctance to depend on them, and whether constraints around zero releases are more permissive than semantic-versioning would imply.
AI-written summary · about
related talks
57mZen and the Art of Package Management
45mNext Gen Package Management
38mDependency Management: The Cause of—and Solution to—All Supply...
41mThe Future of JavaScript Package Management
36mThe Role of Package Managers as Partners in License and Attribution Compliance
22mYou Don't Know Your Dependencies
16mDependency Hell Just Froze Over
25mThe node_modules Iceberg: Mysteries Below the Waterline