Dependency error: Phoenix with gun

odohMei7

I am new to phoenix and want to use it with gun to subscribe to websockets. But when I try this in a phoenix project, I get a dependency error. As a minimal example do the following:

$ mix phx.new --version
Phoenix v1.5.3
$ mix phx.new test --no-ecto
[...]

Then I add gun to the dependencies:

  defp deps do
    [
      {:phoenix, "~> 1.5.3"},
      {:phoenix_html, "~> 2.11"},
      {:phoenix_live_reload, "~> 1.2", only: :dev},
      {:phoenix_live_dashboard, "~> 0.2.0"},
      {:telemetry_metrics, "~> 0.4"},
      {:telemetry_poller, "~> 0.4"},
      {:gettext, "~> 0.11"},
      {:jason, "~> 1.0"},
      {:plug_cowboy, "~> 2.0"},
      {:gun, "~> 1.3.2"},
    ]
  end

But when I do mix deps.get I get the following error:

Resolving Hex dependencies...

Failed to use "cowlib" because
  gun (version 1.3.2) requires ~> 2.6.0
  mix.lock specifies 2.9.1

** (Mix) Hex dependency resolution failed, change the version requirements of your dependencies or unlock them (by using mix deps.update or mix deps.unlock). If you are unable to resolve the conflicts you can try overriding with {:dependency, "~> 1.0", override: true}

What should I do? Thanks in advance.

22 comments

/phoenix #dependencies #cowlib

0 4726 22

2020-07-01 20:58:25 UTC

Showing Posts 22 to 13

Show Best Posts
Show All (oldest first)
Show All (newest first)

benwilson512

Author of Craft GraphQL APIs in Elixir with Absinthe

I think this is a perfectly fine stance to take, I just wanted to make sure that the OP was clear on how mix.lock works.

Post #22

dimitarvp

@benwilson512 and @axelson I know, guys, it’s just that some decisions in some projects in the past (>2 years) weren’t in my power and I’ve had to watch people helplessly fight stuff that could be trivially fixed – as you both pointed out.

I still stand behind my opinion that pointing at a GitHub repo in mix.exs is, if not that non-deterministic, at the very least unclear and should be avoided because it introduces uncertainty. I always use the ref option in this case but I recognize it’s just one way of doing things.

Post #21

benwilson512

Author of Craft GraphQL APIs in Elixir with Absinthe

Yeah as @axelson notes that would only be an issue if you don’t commit your mix.lock file, and you should always commit your mix.lock file.

Post #20

axelson

Scenic Core Team

I’m pretty sure that would only happen if you don’t commit your mix.lock file which you almost always should commit for elixir projects.

Post #19

dimitarvp

Yes, but on non-caching CI/CD the next build will happily pull a version of the dependency that’s not the same as the one on the devs’ machines. That can break tests. Seen it happen, too many times.

Post #18

LostKobrakai

Mix automatically locks to git commits.

Post #17

dimitarvp

Even if that works now you should still not rely on it. A few commits in the future and who knows?

Better find the latest commit hash in the gun repo that works for you now and pin the dependency on it:

      {:gun, github: "ninenines/gun", ref: "921c47146b2d9567eac7e9a4d2ccc60fffd4f327"}

That way, if you can’t rely on a tag or a branch, at least you can lock on a particular commit until you’re comfortable to upgrade the library dependency again in the future.

Post #16

Nicd

Problem here is {:cowlib, "~> 1.9.0", override: true},, there is 1.9.0 but it should be 2.9.0 I think.

Post #15

benwilson512

Author of Craft GraphQL APIs in Elixir with Absinthe

That is correct, I’m pretty sure that should work fine.

Post #14

odohMei7

Ah sorry, I have spotted it myself: 2.9.0 as override works:

$ mix deps.get
Resolving Hex dependencies...
Dependency resolution completed:
Unchanged:
  cowboy 2.8.0
  cowlib 2.9.1
  file_system 0.2.8
  gettext 0.18.0
  jason 1.2.1
  mime 1.3.1
  phoenix 1.5.3
  phoenix_html 2.14.2
  phoenix_live_dashboard 0.2.6
  phoenix_live_reload 1.2.4
  phoenix_live_view 0.13.3
  phoenix_pubsub 2.0.0
  plug 1.10.3
  plug_cowboy 2.3.0
  plug_crypto 1.1.2
  ranch 1.7.1
  telemetry 0.4.2
  telemetry_metrics 0.5.0
  telemetry_poller 0.5.1
* Updating cowlib (Hex package)

So it is still an override and might cause runtime errors but the risk is much smaller since the versions are both 2.9.* right?

Post #13

Load more posts (12 remaining)