enhancement: validate package dependencies when use-package is used in combination with :load-path

[timcharper]

I wonder if it would be useful / appropriate for use-package to validate package dependencies loading a package via load-path. As it stands now, using core emacs functionality, when using a package from source, it seems you must give up all functionality with regards to dependency enforcement.

The thought train behind this is a package like dape (https://github.com/svaante/dape/) requires a newer version of 'jsonrpc than exists today. However, dape is often times installed via source rather than via vendor, and therefore the package-header does not get checked. This led to issues being reported that dape was timing out, which was actually a bug resulting from an unenforced package dependency (one that was expressed in the header, but not enforced).

This led us to think that perhaps dape should assert that jsonrpc is installed and a sufficient version. But, that led to problems with people using alternative packagers, such as straight.el, as packages installed via those means do not advertise installed dependencies via the core emacs function package-installed-p.

On the one hand, straight.el could be programmed to enrich package-installed-p, but on the other hand, is it the job of a package to assert dependencies, or is that the job of a package manager? Contemplating this question for a moment, the answer is clearly the latter.

So, the problem we have is there is not a good way in the cannon Emacs ecosystem to assert package dependencies unless if you explicitly install from a package. And, package.el has a few deficiencies that sometimes push one to install a package from source.

The solution to this is either adopt a heavy solution like 'straight.el', and seemingly wary off the core Emacs path. As an long-time Emacs user, I prefer to stick to core functionality as much as possible, and then minimally modify Emacs to make up for any gaps.

I'm wondering if use-package would be a good place to solve such gaps, and help at least warn about unfulfilled dependencies when using packages from source.

Any thoughts on this?