| Subject: | Historical removal of Method::Inliner can cause Moo installs to be downgraded |
CPAN Testers reports for MongoDB revealed that CPAN code that has a dependency on Method::Inliner can cause Moo to be unexpectedly downgraded.
Avoiding this would require continuing to release Method::Inliner with current Moo, releasing Method::Inliner separately so that its index no longer points at old Moo tarballs, or other CPAN index muckery.
I'm pasting in a copy of email from Andreas Koenig on the subject with further context.
Show quoted text
Show quoted text
>>>>> On Thu, 1 Dec 2016 09:43:29 -0500, David Golden <xdg@xdg.me> said:
> Hi, Andreas. I was looking at
> http://www.cpantesters.org/cpan/report/f2afec2a-b73d-11e6-a669-094ac671d6e6 and
> there seems to be a transitive dependency failure.
Show quoted text > MongoDB requires the BSON distribution (via BSON::Types and
> BSON::Decimal128). BSON requires Moo 2.002004, but this is not
> satisfied and only Moo 2.001001 is installed.
Show quoted text > Could you please look into what happened?
When BSON::Decimal128 was installed we had already Moo 2.002005
installed:
# Module Want Have
# ---------------- -------- ---------
# [...]
# Moo 2.002004 2.002005
and all was good. But before we turned to MongoDB again,
JABRA/MetasploitExpress-Parser-0.02.tar.gz got in the way and that has a
dependency on Method::Inliner. And look what the indexer tells us:
cpan[3]> m Method::Inliner
Module id = Method::Inliner
CPAN_USERID HAARG (Graham Knop <haarg@cpan.org>)
CPAN_VERSION undef
CPAN_FILE H/HA/HAARG/Moo-2.001001.tar.gz
UPLOAD_DATE 2016-03-04
INST_FILE /home/sand/src/perl/repoperls/installed-perls/host/k93x64sid/v5.25.7/f878/lib/site_perl/5.25.7/Method/Inliner.pm
INST_VERSION undef
So we downgraded Moo to 2.001001, and when MongoDB's turn finally came,
we had exactly that instead of the 2.002005.
Options:
- delete Moo-2.001001 and inform all maintainers to find a replacement
for Method::Inliner
- revive Method::Inliner somewhere else, so it cannot cause downgrades
of Moo
- add dependency on Moo to MongoDB
- other?