Rubocop: Cop idea: force gem versions in Gemfile

[alebian]

Hi!

Many times I've seen problems when some gem, without noticing, gets updated to a newer version. I believe that versioning the gems in our Gemfile is a very good practice and we could have a Cop that enforces this.

I've created a prototype for this here.

Let me know what you think about it and if you think this deserves a PR or maybe create an extension gem.

Thanks!

[Drenmi]

I think it's cool. But it's also a good idea to not put a version if you're using a service like Deppbot to continuously update your dependencies. (Different strategies.) So should be configurable to support both. 🙂

[mikegee]

In my opinion, this practice seems like an overkill to avoid reviewing changes to Gemfile.lock.

Check out https://robots.thoughtbot.com/a-healthy-bundle. The author gives an overview of dealing with versions in the Gemfile, including some cases when it is appropriate to not specify a gem's version.

[ghost]

I think it would be nice (if documented behaviour). Although I upped the suggestion, I am not completely sure if rubocop should also check Gemfiles versions per-se. Perhaps if it were an easy change and those who want to use it, would have to enable this behaviour specifically?

[bbatsov]

There hasn't been much activity on this ticket and our Core Team is spread too thin on so many tasks, so I'll just close it for the sake of having a cleaner lists of tasks to focus on. We'd gladly review a PR, but it's unlikely that'd we're going to tackle this ourselves in the foreseeable future.