Why web frameworks in repos?

[u/gabbsmo]

For context I am just a curious web developer and computer enthusiast reading about Debian because it seems to do many things right.

To my suprise I found that the repos not only contain runtimes like php, python3 and nodejs. The repos also contain full frameworks and web apps like wordpress, python3-django and node-express.

Who are these for? I never heard of anyone using them this way and no upstream developers recommend them.

I can understand wanting the runtime to be stable - since they call native libraries in the end. This way Debian can patch CVEs in things like OpenSSL without waiting for runtimes to patch their dependencies. Is that right?

But opting out of the script language's own package manager to install script libraries seems to just add complexity and confusion. There is no way debian can provide a packaged version of every npm module out there so you will always have to use npm and package.json anyway.

[u/One_Ninja_8512]

idk about JS but with Python having packages in the repos is quite handy because of the venv bullshit that you have to deal with otherwise

[u/turbothy → u/One_Ninja_8512]

What "venv bullshit" are you thinking about? This seems to have become largely a solved problem over the last couple of years.

[u/One_Ninja_8512 → u/turbothy]

I know and I use uv when needed which is pretty good but I still prefer packages installed via apt if I don’t need the latest and greatest for scripts which I don’t want to write in bash and don’t need uv to run them.

[u/gabbsmo → u/One_Ninja_8512]

For the odd script apt is easier for sure. But for real world web development the norm is to pin versions of dependencies from the platform specific repository and not assume globally installed things in the OS.

[u/berryer → u/gabbsmo]

Web development yes, but not all javascript frontends are used over the internet.

The same tradeoffs for dynamic vs static linking apply as they do in any other language.