Beefy Boxes and Bandwidth Generously Provided by pair Networks
laziness, impatience, and hubris

What to specify as minimum dependencies

by pokki (Monk)
on Jan 16, 2011 at 21:31 UTC ( #882568=perlquestion: print w/replies, xml ) Need Help??
pokki has asked for the wisdom of the Perl Monks concerning the following question:

Hi monks,

As a Perl developer who is toying with the idea of publishing a module on CPAN for the first time, I've been wondering: what minimum version of the dependencies should I specify for my modules?

Just to clarify, this question is not:

  • how to specify a dependency, or
  • how to get the list of installed modules and their versions, or even
  • how to get the list of modules my module uses

Up to now I've just been doing "use Foo::Bar $baz", where $baz is the current CPAN version at the time I'm writing the module, and the version I have installed on my system. Is this OK? It seems drastic to require bleeding edge dependencies. How do I find out what's the minimum version of each dependency my module will still run with?

P.S. I can't think of an appropriate, concise and searchable title for this node. Please advise.

  • Comment on What to specify as minimum dependencies

Replies are listed 'Best First'.
Re: What to specify as minimum dependencies
by Corion (Pope) on Jan 16, 2011 at 21:38 UTC

    Personally, unless I already know better, I specify no minimum version in my prerequisites (in Makefile.PL):

    ... 'PREREQ_PM' => { 'AnyEvent' => '0', 'AnyEvent::HTTP' => '0', # for the reverse se +arch 'Growl::Any' => '0', # for the notification }, # e.g., Module::Name => 1.1 ...

    If, thanks to the CPAN testers, I find that a module version is problematic, I bump my prerequisite version number above that, but by default, I'm lenient in what I accept.

      That seems a fair way to go about it, thanks! I hadn't even thought of specifying no minimum version.

      If, thanks to the CPAN testers, I find that a module version is problematic, I bump my prerequisite version number above that

      Do you need to do that often after uploading a module? I guess it depends on whether the authors of your prerequisites changed their API often?

        The "most problematic" module regarding its API was LWP::UserAgent, an indirect prerequisite (through WWW::Mechanize) for WWW::Mechanize::Shell. At a certain version, WWW::Mechanize monkeypatched LWP::UserAgent to provide credentials, and at another version, LWP::UserAgent changed its scheme so that the monkeypatch changed the wrong routine. WWW::Mechanize didn't specify the LWP version number until a later release, so after some trial and error, I pulled up the prerequisite version number of WWW::Mechanize to fix that.

        This was a one time thing so far, so I haven't felt it a real nuisance.

Re: What to specify as minimum dependencies
by JavaFan (Canon) on Jan 16, 2011 at 22:33 UTC
    Unless I know I'm using a feature of a module that was introduced after the module was first released, or if I know old versions of a module are buggy, I won't specify a minimum version.

      That makes sense. Thank you (all) for your answers!

Re: What to specify as minimum dependencies
by BrowserUk (Pope) on Jan 17, 2011 at 00:11 UTC
    How do I find out what's the minimum version of each dependency my module will still run with?

    This has already been said by several people that you should give considerably more weight to than I, but when I read your question, this was my first reaction. The difference is that I'll tell you why. My answer to the above question is:


    That is, if you don't know what to do, do nothing. When you know action is required, you'll probably also know what action is required. But speculating about what action might be required, before you have evidence it actually is, is counter productive. In English. A total waste of time.

    Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.
    "Science is about questioning the status quo. Questioning authority".
    In the absence of evidence, opinion is indistinguishable from prejudice.
Re: What to specify as minimum dependencies
by Your Mother (Bishop) on Jan 16, 2011 at 23:21 UTC

    If going with Module::Install you can do this in your Makefile.PL–

    use inc::Module::Install; # Define metadata name 'Your-Module'; all_from 'lib/Your/'; # Specific dependencies requires 'File::Spec' => '0.80'; test_requires 'Test::More' => '0.42'; recommends 'Text::CSV_XS'=> '0.50'; no_index 'directory' => 'demos'; install_script 'myscript'; WriteAll;

    I’m with JavaFan, don't specify a version unless you know you have a reason to do so (feature or bug solved in X.XX for example). CPAN tester failures will probably notify you over time if you missed one that mattered and you can add it then.

    Module::ScanDeps might be what you want for getting your dependencies straight but it's probably going to be much more verbose than necessary. Unless you have a monster set of modules, doing it by hand is better. Otherwise a one-liner or two looking for use\swhatever might serve better to get a list of what you're directly loading (and let those package take care of their own dependencies—unless you know they are broken in that regard, which does happen).

Re: What to specify as minimum dependencies
by Anonymous Monk on Jan 16, 2011 at 21:41 UTC
Re: What to specify as minimum dependencies
by Tux (Abbot) on Jan 17, 2011 at 08:01 UTC

    I also always make sure to require a minimum version of Test::More to make sure I have done_testing (unless the module should support perl versions that are too old to have that module version installed).

    Next to required modules, you can also add modules that you think are better/safer/faster for your purpose, but not an actual prerequisite.

    You can use any of the below described methods to do so, but you can also handcraft META.yml or META.jsn to reflect your desires as recommendations:

    requires: perl: 5.006 Exporter: 0 Carp: 0 Data::Dumper: 0 configure_requires: ExtUtils::MakeMaker: 0 build_requires: perl: 5.006 Test::Harness: 0 Test::More: 0.88 Test::NoWarnings: 0 recommends: perl: 5.012002 File::Temp: 0.22 IO::Scalar: 0 Test::More: 0.96

    As you can see, both the requirement section and the recommendation section mention Test::More, but with different versions.

    Enjoy, Have FUN! H.Merijn
      Considering that testing isn't a *building* requirement, I put my testing modules under test_requires, not under build_requires. So, I may have as part of the args to WriteMakefile:
      PREREQ_PM => { 'strict' => 0, 'warnings' => 0, }, MIN_PERL_VERSION => 5.006, META_MERGE => { test_requires => { 'Test' => 0, 'Test::More' => 0, }, }
      which gets translated to the following YAML:
      configure_requires: ExtUtils::MakeMaker: 0 build_requires: ExtUtils::MakeMaker: 0 requires: perl: 5.006 strict: 0 warnings: 0 test_requires: Test: 0 Test::More: 0
Re: What to specify as minimum dependencies
by sundialsvc4 (Abbot) on Jan 17, 2011 at 14:26 UTC

    I do not specify version dependencies unless I happen to know (or to see from the CPAN pages) that there is a particular version that it will not work with.   And, I concern myself with this only with code that I intend to distribute.   Normally, I do control the installation of both the software that I have developed, and the packages that go with them, and both are installed from current sources at the same time.

    I conscientiously avoid dependencies on “what is already installed,” e.g. at the hosting service.   I supply everything that is needed, in the version that is known-good.

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: perlquestion [id://882568]
Approved by moritz
Front-paged by moritz
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others exploiting the Monastery: (4)
As of 2018-06-24 13:36 GMT
Find Nodes?
    Voting Booth?
    Should cpanminus be part of the standard Perl release?

    Results (126 votes). Check out past polls.