Is this correct to import the dependency of a dependency?

[adtrevor]

Code that imports a dependency from one of it's dependencies does compile (even if it doesn't explicitly add it to it's dependencies), it surprises me as it would imply, for a package, that changing a dependency (even just the major version) is a source breaking change as clients might also depend on it?

What is the right way?

Thank you

[SDGGiesbrecht (Jeremy David Giesbrecht)]

@adtrevor

What is the right way?

If you consciously import it, declare it as your own dependency too.

---

@adtrevor

Code that imports a dependency from one of it's dependencies does compile

Some amount of implicit re‐exporting is usually necessary. That whole problem domain is a bit of a mess right now though:

@_exported and fixing import visibility

I told @Jon_Shier I'd write something up on @_exported and visibility in general, so here it is. It's a bit of a brain dump, but I know if I wait until I have time to edit it it won't get posted for months. (That's already true, in fact; I've had this model kicking around my head for probably close to a year now.) So, thanks for the prompt, Jon. Today, if your Swift library "Foo" uses a library "Bar", the headers (or swiftmodule files) of "Bar" must be available to all clients of "Foo". This i…

---

@adtrevor

it would imply, for a package, that changing a dependency (even just the major version) is a source breaking change as clients might also depend on it?

This is not Swift‐specific. Even if all you do is reduce the range of a dependency you declare compatibility with, you’ve reduced the range of that same dependency that your clients can use at the same time as your package. The general principle of semantic versioning is that your version only represents your own vended API. If your client discovers they care about the differences in a sub‐dependency, they can declare it as their own dependency and select whatever range they want. It may restrict them from updating yours, but nothing breaks in their code. If they don’t notice, and their client doesn’t notice, and their client’s client doesn’t notice, then their client’s client’s client still has the same recourse to declare it themselves, so nothing is ever broken.

See also: semver.org’s own FAQ entry

[adtrevor]

Thank you for this information, it didn't feel like a correct approach to do this but I was surprised that it was actually allowed by the compiler without any warning, it's nice to know that it will probably improve in the future.