On Sun, Sep 15, 2024 at 5:09 PM Martin Edstrom <meedstrom@runbox.eu> wrote:
The "catastrophe" would be a situation such as:

- In 2020, Developer releases Package for the first time
- In 2021, Developer tires of bumping Package-Version, leaves it at 0.9
- In 2024, Package is now at 2.2 according to the convenient git/hg tag, or maybe it has no official version beyond just "0.9.0.50-git"
- User installs Package using (use-package :vc)
- User gets the version from 2021
[...]

You're describing the situation in terms of theoretical user results, but that's not how the code works, obviously. At some point, the code checks the user's value of use-package-vs-prefer-newest, sees whether it's the default or has been customized, and decides to fetch the new package contents or not. My rough understanding is, *in the non-VC case*, it downloads new archive-contents for the (each) entire archive regardless, and then I'm guessing that it currently uses the setting to determine whether to get a new version or not.

I don't know how the code path in the (use-package :vc) works, but presumably there's a clear point where the two behaviors (that is, vc-use-package's supposed former update-by-default versus use-package :vc's ...prefer-newer 'nil lack of update) diverge. I'm asking if there's a reasonable way to change the default behavior from the supposed-old yes-update and the current default wait-for-Package-version into something that leaves the package alone but warns the user, perhaps via *Messages*.

Put another way, your concern seems to be that people might not _realize_ that they're "stuck" on an older Package-Version revision. The alternative package "manager" code for emacs suggests that there is desire both for version pinning and direct-from-vcs-packages, so it's likely that there are users who prefer both alternatives, and emacs is often default-conservative in such matters, but it seems like it might be possible to have use-package do a little extra work in the default case to address the "not realize" part, rather than changing the updating behavior itself.

Hope that helps,
~Chad