Knowledge (XXG)

Dependency hell

Source 📝

899:
your system with newer versions. As long as packages are always perfectly backward-compatible, this is not a problem, but in the real world, packages are anything but perfectly backward-compatible. Suppose you upgrade Firefox, and your package manager decides that you need a newer version of GTK as well. If the new GTK is not quite backward-compatible, then other applications on your system might suddenly break. In the Windows world a similar problem is known as the DLL hell, but dependency hell is just as much a problem in the Unix world, if not a bigger one, because Unix programs tend to have many external dependencies.
293:, then upgrading any application will break another. This scheme can be deeper in branching. Its impact can be quite heavy if it affects core systems or update software itself: a package manager (A), which requires specific run-time library (B) to function, may break itself (A) in the middle of the process when upgrading this library (B) to next version. Due to incorrect library (B) version, the package manager (A) is now broken, thus no rollback or downgrade of library (B) is possible. The usual solution is to download and deploy both applications, sometimes from within a temporary environment. 22: 167:, requiring lengthy downloads, large amounts of disk space, and being very portable (all libraries are already ported enabling the application itself to be ported easily). It can also be difficult to locate all the dependencies, which can be fixed by having a repository (see below). This is partly inevitable; an application built on a given 547:
or component library designers and quickly adjust their software with updates for their users, all with minimal effort and a lack of costly and time-consuming redesign. This method would encourage programmers to pressure those upon whom they depend to maintain a reasonable notification process that is not onerous to anyone involved.
383:. The major version only changes when programs that used that version will no longer be compatible. The minor version might change with even a simple revision that does not prevent other software from working with it. In cases like this, software packages can then simply request a component that has a particular major version, and 147:
packages or libraries, but they depend on different and incompatible versions of the shared packages. If the shared package or library can only be installed in a single version, the user may need to address the problem by obtaining newer or older versions of the dependent packages. This, in turn, may
546:
If application software is designed in such a way that its programmers are able to easily adapt the interface layer that deals with the OS, window manager or desktop environment to new or changing standards, then the programmers would only have to monitor notifications from the environment creators
260:
cannot simultaneously be used (or installed, if the installer checks dependencies). When possible, this is solved by allowing simultaneous installations of the different dependencies. Alternatively, the existing dependency, along with all software that depends on it, must be uninstalled in order to
427:
version number constraints, effectively transferring the responsibility for brokering library/module versions from the applications to the operating system. A shared module can then be placed in a central repository without the risk of breaking applications which are dependent on previous or later
354:
Many software libraries are written in a generous way, in an attempt to fulfill most users' needs, but sometimes only a small portion of functions are required in the host code. By examining the source, the functionality can be rewritten in a much more compact way (with respect to the license). In
898:
All popular package managers, including APT, RPM and the FreeBSD Ports Collection, suffer from the problem of destructive upgrades. When you perform an upgrade -- whether for a single application or your entire operating system -- the package manager will overwrite the files that are currently on
553:
If the applications and libraries are developed and maintained with guaranteed downward compatibility in mind, any application or library can be replaced with a newer version at any time without breaking anything. While this does not alleviate the multitude of dependency, it does make the jobs of
387:
minor version (greater than or equal to a particular minor version). As such, they will continue to work, and dependencies will be resolved successfully, even if the minor version changes. Semantic Versioning (aka "SemVer") is one example of an effort to generate a technical specification that
582:
An application (or version of an existing conventional application) that is completely self-contained and requires nothing to be already installed. It is coded to have all necessary components included, or is designed to keep all necessary files within its own directory, and will not create a
401:
prevented applications from overwriting system DLLs. Developers were instead encouraged to use "Private DLLs", copies of libraries per application in the directory of the application. This uses the Windows search path characteristic that the local path is always prioritized before the system
221:
below). These long chains of dependencies can be solved by having a package manager that resolves all dependencies automatically. Other than being a hassle (to resolve all the dependencies manually), manual resolution can mask dependency cycles or
566:. A software appliance encapsulates dependencies in a pre-integrated self-contained unit such that users no longer have to worry about resolving software dependencies. Instead the burden is shifted to developers of the software appliance. 261:
install the new dependency. A problem on Linux systems with installing packages from a different distributor (which is not recommended) is that the resulting long chain of dependencies may lead to a conflicting version of the
512:
or, much less commonly, directories on removable media such as CDs or DVDs. This eliminates dependency hell for software packaged in those repositories, which are typically maintained by the Linux distribution provider and
517:
worldwide. Although these repositories are often huge, it is not possible to have every piece of software in them, so dependency hell can still occur. In all cases, dependency hell is still faced by the repository
325:
When a library A depends on libraries B and C, both B and C depend on library D, but B requires version D.1 and C requires version D.2. The build fails because only one version of D can exist in the final
618:
toolkit, which these programs use to render widgets. On the other hand, if different versions of GTK are required by each application, then this is the correct behavior and successfully avoids dependency
423:
The version numbering solution can be improved upon by elevating the version numbering to an operating system supported feature. This allows an application to request a module/library by a unique name
598:
This method of distribution has also proven useful when porting applications designed for Unix-like platforms to Windows, the most noticeable drawback being multiple installations of the same
175:) requires that platform to be installed, but further applications do not require it. This is a particular problem if an application uses a small part of a big library (which can be solved by 402:
directory with the system wide libraries. This allows easy and effective shadowing of library versions by specific application ones, therefore preventing dependency hell.
453:
can perform smart upgrades, in which interdependent software components are upgraded at the same time, thereby resolving the major number incompatibility issue too.
912: 217:, and so on. Sometimes, however, during this long chain of dependencies, conflicts arise where two different versions of the same package are required (see 303:), but this is unlikely since major package managers have matured and official repositories are well maintained. This is the case with current releases of 804: 355:
general, this can reduce significantly the application code and, later, the maintenance costs, and programmers can improve their software writing skills.
363:
A very common solution to this problem is to have a standardized numbering system, wherein software uses a specific number for each version (aka
1090: 417:, which avoids breakage if system libraries are upgraded or changed. It uses its own "PBI" (Push Button Installer) for package management. 1075: 836: 540:
can resolve this by presenting the user with a range of solutions, and allowing the user to accept or reject the solutions, as desired.
952: 525: 439:
is an implementation of such a central registry with associated services and integrated with the installation system/package manager.
781: 105: 1080: 39: 704: 133: 86: 43: 58: 333:
are prone to have conflicts between packages of their repositories, causing dependency hell in Linux distributions such as
710: 201:. This is distinct from "many dependencies" if the dependencies must be resolved manually, e.g., on attempting to install 595:, which work in much the same way: programs and their dependencies are self-contained in their own directories (folders). 583:
dependency problem. These are often able to run independently of the system to which they are connected. Applications in
916: 881: 443:
solves this problem with a concept called slotting, which allows multiple versions of shared libraries to be installed.
65: 269:), on which thousands of packages depend. If this happens, the user will be prompted to uninstall all those packages. 567: 464:-based package management systems to try to solve the dependency problem. These systems are a layer on top of the 32: 308: 72: 472:, or other packaging systems that are designed to automatically resolve dependencies by searching in predefined 1085: 811: 698: 338: 172: 428:
versions of the module. Each version gets its own entry, side by side with other versions of the same module.
1060: 537: 477: 394: 299:
It is possible for dependency hell to result from installing a prepared package via a package manager (e.g.
54: 501: 1022: 228:
Solving the dependencies for one software may break the compatibility of another in a similar fashion to
592: 505: 436: 311:. Dependency hell, however, can result from installing a package directly via a package installer (e.g. 272: 660: 577: 987: 976: 856: 740: 735: 599: 473: 465: 371: 365: 312: 164: 137: 725: 646: 629: 563: 557: 536:
of requirements, as each new package demands several more be installed. Systems such as Debian's
493: 262: 168: 773: 524:
Because different pieces of software have different dependencies, it is possible to get into a
848: 777: 640: 571: 432: 79: 692: 656: 509: 176: 956: 632:, "dependency hell" often goes by a local specific name, generally the name of components. 1055: 715: 461: 450: 129: 766: 730: 679: 650: 533: 481: 330: 1069: 266: 125: 664: 440: 398: 300: 229: 1000: 588: 529: 143:
The dependency issue arises when several packages have dependencies on the same
21: 695:
a literary depiction of situations where something depends on its own negation
562:
Another approach to avoiding dependency issues is to deploy applications as a
497: 388:
employs specifically formatted numbers to create a software versioning scheme.
1045: 852: 885: 148:
break other dependencies and push the problem to another set of packages.
745: 636: 574:
and Docker Hub) can be seen as an implementation of software appliances.
671: 611: 584: 514: 410: 701: – techniques and tools for managing software versions 670:
RPM hell – a form of dependency hell occurring in the
413:) places packages and dependencies into self-contained directories in 720: 406: 334: 304: 550:
Strict compatibility requirement in code development and maintenance
289:, in turn, depends upon and can't run without a specific version of 118:
Colloquial term for software requiring many conflicting dependencies
1050: 675: 603: 485: 457: 639: – a form of dependency hell occurring on 16-bit 607: 489: 469: 316: 707: – forms of dependency among software artifacts 837:"It's Good Work When You Can Find It; The Dependency Carousel" 659: – a form of dependency hell occurring in the 649: – a form of dependency hell occurring on the 615: 128:
for the frustration of some software users who have installed
15: 880:
Pjotr Prins; Jeeva Suresh & Eelco Dolstra (2008-12-22).
405:
PC-BSD, up to and including version 8.2, a predecessor of
281:
depends upon and can't run without a specific version of
882:"Nix fixes dependency hell on all Linux distributions" 937: 875: 873: 500:
and others. Typically, the software repositories are
179:), or a simple application relies on many libraries. 290: 286: 282: 278: 257: 253: 249: 245: 241: 237: 233: 214: 210: 206: 202: 198: 194: 190: 186: 46:. Unsourced material may be challenged and removed. 765: 435:operating systems since Windows Vista, where the 369:), and also a subnumber for each revision (aka 420:Side-by-side installation of multiple versions 8: 570:and their images (such as those provided by 554:package managers or installers much easier. 805:"Improved Portability of Shared Libraries" 508:on the local computer or shared across a 252:cannot be simultaneously installed, then 106:Learn how and when to remove this message 756: 213:, the user is then prompted to install 810:. Princeton University. Archived from 602:. For example, Windows installers for 156:Dependency hell takes several forms: 7: 847:(5). www.drdobbs.com/blog: 121–124. 614:all include identical copies of the 476:. Examples of these systems include 460:distributions have also implemented 44:adding citations to reliable sources 209:first and on attempting to install 205:, the user is prompted to install 14: 678:and other distributions that use 543:Easy adaptability in programming 391:Private per application versions 20: 955:. microsoft.com. Archived from 163:An application depends on many 31:needs additional citations for 1021:Weinstein, Paul (2003-09-11). 409:(an operating system based on 307:and major derivatives such as 1: 1091:Software engineering folklore 951:Anderson, Rick (2000-01-11). 938:"Project website: semver.org" 711:Dynamic dead code elimination 803:Donald, James (2003-01-25). 667:solved this problem in 2004. 296:Package manager dependencies 248:, and different versions of 140:of other software packages. 884:. linux.com. Archived from 182:Long chains of dependencies 1107: 1076:Package management systems 835:Stevens, Al (2001-05-01). 772:. O'Reilly Media. p.  768:Linux annoyances for geeks 1001:"Application directories" 431:This solution is used in 699:Configuration management 663:before build tools like 661:Java Runtime Environment 446:Smart package management 339:Red Hat Enterprise Linux 225:Conflicting dependencies 219:conflicting dependencies 197:, ..., which depends on 1081:Version control systems 593:application directories 538:Advanced Packaging Tool 532:, or an ever-expanding 395:Windows File Protection 329:Package managers like 953:"The End of DLL Hell" 913:"Yum Dependency Hell" 764:Michael Jang (2006). 682:as a package manager. 578:Portable applications 474:software repositories 437:Global Assembly Cache 351:Removing dependencies 273:Circular dependencies 1046:Context independence 1025:. linuxdevcenter.com 1023:"Is Linux Annoying?" 40:improve this article 1056:Implicit dependency 741:Nix package manager 736:Supply chain attack 630:computing platforms 558:Software appliances 504:sites or websites, 193:, which depends on 726:Software appliance 647:Extension conflict 564:software appliance 322:Diamond dependency 263:C standard library 169:computing platform 1051:Dependency walker 641:Microsoft Windows 624:Platform-specific 521:Installer options 433:Microsoft Windows 360:Version numbering 160:Many dependencies 130:software packages 116: 115: 108: 90: 55:"Dependency hell" 1098: 1034: 1033: 1031: 1030: 1018: 1012: 1011: 1009: 1007: 997: 991: 985: 979: 974: 968: 967: 965: 964: 948: 942: 941: 934: 928: 927: 925: 924: 915:. Archived from 909: 903: 902: 894: 893: 877: 868: 867: 865: 864: 855:. Archived from 832: 826: 825: 823: 822: 816: 809: 800: 794: 793: 791: 790: 771: 761: 674:distribution of 600:shared libraries 451:package managers 292: 288: 284: 280: 259: 255: 251: 247: 243: 239: 235: 216: 212: 208: 204: 200: 196: 192: 188: 177:code refactoring 111: 104: 100: 97: 91: 89: 48: 24: 16: 1106: 1105: 1101: 1100: 1099: 1097: 1096: 1095: 1086:Computer errors 1066: 1065: 1042: 1037: 1028: 1026: 1020: 1019: 1015: 1005: 1003: 999: 998: 994: 986: 982: 975: 971: 962: 960: 950: 949: 945: 936: 935: 931: 922: 920: 911: 910: 906: 891: 889: 879: 878: 871: 862: 860: 834: 833: 829: 820: 818: 814: 807: 802: 801: 797: 788: 786: 784: 763: 762: 758: 754: 716:Package manager 689: 626: 348: 154: 126:colloquial term 122:Dependency hell 119: 112: 101: 95: 92: 49: 47: 37: 25: 12: 11: 5: 1104: 1102: 1094: 1093: 1088: 1083: 1078: 1068: 1067: 1064: 1063: 1058: 1053: 1048: 1041: 1040:External links 1038: 1036: 1035: 1013: 992: 980: 969: 943: 929: 904: 869: 827: 795: 782: 755: 753: 750: 749: 748: 743: 738: 733: 731:Static library 728: 723: 718: 713: 708: 702: 696: 688: 685: 684: 683: 668: 654: 651:classic Mac OS 644: 625: 622: 621: 620: 596: 591:for Linux use 580: 575: 560: 555: 551: 548: 544: 541: 528:of dependency 526:vicious circle 522: 519: 454: 447: 444: 429: 421: 418: 403: 397:introduced in 392: 389: 361: 357: 356: 352: 347: 344: 343: 342: 327: 323: 320: 297: 294: 275: 270: 226: 223: 183: 180: 161: 153: 150: 117: 114: 113: 28: 26: 19: 13: 10: 9: 6: 4: 3: 2: 1103: 1092: 1089: 1087: 1084: 1082: 1079: 1077: 1074: 1073: 1071: 1062: 1061:MacDependency 1059: 1057: 1054: 1052: 1049: 1047: 1044: 1043: 1039: 1024: 1017: 1014: 1002: 996: 993: 990:on gentoo.org 989: 984: 981: 978: 973: 970: 959:on 2001-06-05 958: 954: 947: 944: 939: 933: 930: 919:on 2016-12-19 918: 914: 908: 905: 901: 900: 888:on 2015-07-08 887: 883: 876: 874: 870: 859:on 2011-08-11 858: 854: 850: 846: 842: 838: 831: 828: 817:on 2007-09-26 813: 806: 799: 796: 785: 783:9780596552244 779: 775: 770: 769: 760: 757: 751: 747: 744: 742: 739: 737: 734: 732: 729: 727: 724: 722: 719: 717: 714: 712: 709: 706: 703: 700: 697: 694: 691: 690: 686: 681: 677: 673: 669: 666: 662: 658: 655: 652: 648: 645: 642: 638: 635: 634: 633: 631: 623: 617: 613: 609: 605: 601: 597: 594: 590: 586: 581: 579: 576: 573: 569: 565: 561: 559: 556: 552: 549: 545: 542: 539: 535: 531: 527: 523: 520: 516: 511: 507: 503: 499: 495: 491: 487: 483: 479: 475: 471: 467: 463: 459: 456:Many current 455: 452: 448: 445: 442: 438: 434: 430: 426: 422: 419: 416: 412: 408: 404: 400: 396: 393: 390: 386: 382: 378: 374: 373: 372:minor version 368: 367: 366:major version 362: 359: 358: 353: 350: 349: 345: 340: 336: 332: 328: 324: 321: 318: 314: 310: 306: 302: 298: 295: 291:application A 287:application B 283:application B 279:application A 276: 274: 271: 268: 267:GNU C Library 264: 231: 227: 224: 220: 184: 181: 178: 174: 170: 166: 162: 159: 158: 157: 151: 149: 146: 141: 139: 135: 131: 127: 123: 110: 107: 99: 88: 85: 81: 78: 74: 71: 67: 64: 60: 57: –  56: 52: 51:Find sources: 45: 41: 35: 34: 29:This article 27: 23: 18: 17: 1027:. Retrieved 1016: 1004:. Retrieved 995: 983: 972: 961:. Retrieved 957:the original 946: 932: 921:. Retrieved 917:the original 907: 897: 896: 890:. Retrieved 886:the original 861:. Retrieved 857:the original 844: 840: 830: 819:. Retrieved 812:the original 798: 787:. Retrieved 767: 759: 665:Apache Maven 628:On specific 627: 530:requirements 518:maintainers. 441:Gentoo Linux 424: 414: 399:Windows 2000 384: 380: 376: 370: 364: 230:whack-a-mole 218: 155: 144: 142: 136:on specific 134:dependencies 121: 120: 102: 93: 83: 76: 69: 62: 50: 38:Please help 33:verification 30: 1006:7 September 589:ROX Desktop 506:directories 326:executable. 244:depends on 236:depends on 189:depends on 132:which have 96:August 2024 1070:Categories 1029:2010-04-10 963:2010-07-07 923:2015-12-28 892:2013-05-22 863:2010-04-10 821:2010-04-09 789:2012-02-16 752:References 568:Containers 462:repository 265:(e.g. the 246:libfoo 1.3 238:libfoo 1.2 222:conflicts. 66:newspapers 853:1044-789X 415:/Programs 379:.1, or 5. 375:), e.g.: 346:Solutions 171:(such as 165:libraries 988:Slotting 746:Left-pad 705:Coupling 693:Catch-22 687:See also 657:JAR hell 637:DLL Hell 587:and the 515:mirrored 152:Problems 138:versions 672:Red Hat 612:HexChat 585:RISC OS 510:network 494:Portage 411:FreeBSD 80:scholar 977:pbiDIR 851:  780:  610:, and 572:Docker 498:Pacman 407:TrueOS 335:CentOS 309:Ubuntu 305:Debian 285:, but 250:libfoo 240:, and 145:shared 82:  75:  68:  61:  53:  841:J-DDJ 815:(PDF) 808:(PDF) 676:Linux 619:hell. 604:gedit 486:Urpmi 458:Linux 449:Some 232:. If 124:is a 87:JSTOR 73:books 1008:2013 849:ISSN 778:ISBN 608:GIMP 534:tree 490:ZYpp 470:dpkg 337:and 317:dpkg 258:app2 256:and 254:app1 242:app2 234:app1 215:libb 211:liba 207:liba 199:libz 195:libb 191:liba 173:Java 59:news 774:325 721:PBI 680:RPM 616:GTK 502:FTP 482:Yum 478:Apt 466:RPM 425:and 385:any 331:yum 315:or 313:RPM 301:APT 277:If 203:app 187:app 185:If 42:by 1072:: 895:. 872:^ 845:26 843:. 839:. 776:. 606:, 496:, 492:, 488:, 484:, 480:, 468:, 377:10 319:). 1032:. 1010:. 966:. 940:. 926:. 866:. 824:. 792:. 653:. 643:. 381:7 341:. 109:) 103:( 98:) 94:( 84:· 77:· 70:· 63:· 36:.

Index


verification
improve this article
adding citations to reliable sources
"Dependency hell"
news
newspapers
books
scholar
JSTOR
Learn how and when to remove this message
colloquial term
software packages
dependencies
versions
libraries
computing platform
Java
code refactoring
whack-a-mole
C standard library
GNU C Library
Circular dependencies
APT
Debian
Ubuntu
RPM
dpkg
yum
CentOS

Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.