{"action":"created","issue":{"url":"https://api.github.com/repos/golang/dep/issues/328","repository_url":"https://api.github.com/repos/golang/dep","labels_url":"https://api.github.com/repos/golang/dep/issues/328/labels{/name}","comments_url":"https://api.github.com/repos/golang/dep/issues/328/comments","events_url":"https://api.github.com/repos/golang/dep/issues/328/events","html_url":"https://github.com/golang/dep/issues/328","id":213907838,"number":328,"title":"merge overrides sections with “dependencies\" constraint by default","user":{"login":"thefallentree","id":1256464,"avatar_url":"https://avatars3.githubusercontent.com/u/1256464?v=3","gravatar_id":"","url":"https://api.github.com/users/thefallentree","html_url":"https://github.com/thefallentree","followers_url":"https://api.github.com/users/thefallentree/followers","following_url":"https://api.github.com/users/thefallentree/following{/other_user}","gists_url":"https://api.github.com/users/thefallentree/gists{/gist_id}","starred_url":"https://api.github.com/users/thefallentree/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thefallentree/subscriptions","organizations_url":"https://api.github.com/users/thefallentree/orgs","repos_url":"https://api.github.com/users/thefallentree/repos","events_url":"https://api.github.com/users/thefallentree/events{/privacy}","received_events_url":"https://api.github.com/users/thefallentree/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-03-13T21:49:26Z","updated_at":"2017-03-14T12:55:05Z","closed_at":null,"body":"Hi,\r\n\r\nI spend quite a while to figure out why my solver insist on choosing broken versions even if I put correct version in the \"dependencies\" sections already, turns out I need them in the \"overrides\" section instead, because I don't use them directly in the code, but it was referenced from other code.\r\n\r\nSo, I think a sane default would be always populate from dependencies."},"comment":{"url":"https://api.github.com/repos/golang/dep/issues/comments/286412163","html_url":"https://github.com/golang/dep/issues/328#issuecomment-286412163","issue_url":"https://api.github.com/repos/golang/dep/issues/328","id":286412163,"user":{"login":"sdboyer","id":21599,"avatar_url":"https://avatars3.githubusercontent.com/u/21599?v=3","gravatar_id":"","url":"https://api.github.com/users/sdboyer","html_url":"https://github.com/sdboyer","followers_url":"https://api.github.com/users/sdboyer/followers","following_url":"https://api.github.com/users/sdboyer/following{/other_user}","gists_url":"https://api.github.com/users/sdboyer/gists{/gist_id}","starred_url":"https://api.github.com/users/sdboyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sdboyer/subscriptions","organizations_url":"https://api.github.com/users/sdboyer/orgs","repos_url":"https://api.github.com/users/sdboyer/repos","events_url":"https://api.github.com/users/sdboyer/events{/privacy}","received_events_url":"https://api.github.com/users/sdboyer/received_events","type":"User","site_admin":false},"created_at":"2017-03-14T12:55:05Z","updated_at":"2017-03-14T12:55:05Z","body":"Having constraints apply only to direct dependencies is a carefully-calibrated design choice. Doing as you suggest would have [unfortunate, complex side effects](https://gist.github.com/sdboyer/b0813bf2b9dba58a335a85092085472f). Unfortunately, taking this approach does mean, at least while the community is transitioning to the new system, there may be issues with unruly transitive deps, as you're experiencing.\r\n\r\nThere are a few different means of recourse. In roughly descending order of (my) preference:\r\n\r\n1. Manually tweak the `lock.json` file to the versions of the transitive deps that you want. As long as you don't issue a blanket `dep ensure -update`, and nothing else imposes constraints on those transitive deps, you'll get a stable build with those versions you want. A 😭 approach, I know, but it works right now.\r\n2. If we were to automatically convert other tool's (glide, godep, govendor, etc.) metadata files on the fly, it could mitigate this problem, particularly through the use of [preferred versions](https://github.com/sdboyer/gps/wiki/gps-for-Implementors#preferred-versions). The problem with this approach is it could disincentivize the ecosystem from migrating to new tooling.\r\n3. Use overrides, as you have. Overrides are a sledgehammer, and should be avoided if possible - they're really most appropriate when you need to solve a conflict, rather than enforce order transitively. But obviously, your dep set needs to be what you need it to be.\r\n\r\nIn any case, this could use improved documentation. At this point, I think our big difficulty with docs is just knowing where to put them/how to organize them. Since you're coming fresh off a struggle with this (sorry!), do you have an idea about where you would have thought to look to figure out the problem you were having?"}}
{"actor":{"display_login":"sdboyer"}}