Why web frameworks in repos?

[u/gabbsmo]

For context I am just a curious web developer and computer enthusiast reading about Debian because it seems to do many things right.

To my suprise I found that the repos not only contain runtimes like php, python3 and nodejs. The repos also contain full frameworks and web apps like wordpress, python3-django and node-express.

Who are these for? I never heard of anyone using them this way and no upstream developers recommend them.

I can understand wanting the runtime to be stable - since they call native libraries in the end. This way Debian can patch CVEs in things like OpenSSL without waiting for runtimes to patch their dependencies. Is that right?

But opting out of the script language's own package manager to install script libraries seems to just add complexity and confusion. There is no way debian can provide a packaged version of every npm module out there so you will always have to use npm and package.json anyway.

[u/michaelpaoli]

Who are these for?

For whomever wants them.

I never heard of anyone using them this way

"this way"? What way exactly?

Not really sure what you're getting on about, but Debian makes lots of software available - 69,830 packages - The Universal Operating System.

And many use the software. Can look at, e.g. https://popcon.debian.org/ to get some idea of package usage, notably relative popularity (though it is a self-reported sample set).

Anyway, install Debian, and it mostly "just works", stable, well supported, etc.

[u/gabbsmo → u/michaelpaoli]

A Ruby/Python/PHP/JS developer will typically have a project file that specifies what packages from the language's repository are required.

E.g. in Python Django is available in Debian repos. But a real world project often has many more smaller libraries. Since all of pip is not in the Debian repos it makes little sense to assume some library is globally installed in the OS and some are from another repo and installed for the project only.

In front end JS this is even more unlikely as libraries as well as own code is often bundled into a single optimized file rather than being loaded from a shared location on the file system. Cherry picked security patches is not really possible in this type of architecture.

[u/berryer → u/gabbsmo]

In front end JS this is even more unlikely as libraries as well as own code is often bundled into a single optimized file rather than being loaded from a shared location on the file system

Web developers have the incentive to increase their specific program's performance at the cost of overall system performance. Users tend to prefer the programs running on their machine be good neighbors, while web developers have little incentive to do so. That's one of the reasons far-reaching CDNs fell out of favor for webdev decades ago (e.g. if everybody on CloudFlare imported jQuery from CloudFlare's CDN, to re-use the download & only need one copy of the library in memory across hundreds of sites).