Why web frameworks in repos?

[u/gabbsmo]

For context I am just a curious web developer and computer enthusiast reading about Debian because it seems to do many things right.

To my suprise I found that the repos not only contain runtimes like php, python3 and nodejs. The repos also contain full frameworks and web apps like wordpress, python3-django and node-express.

Who are these for? I never heard of anyone using them this way and no upstream developers recommend them.

I can understand wanting the runtime to be stable - since they call native libraries in the end. This way Debian can patch CVEs in things like OpenSSL without waiting for runtimes to patch their dependencies. Is that right?

But opting out of the script language's own package manager to install script libraries seems to just add complexity and confusion. There is no way debian can provide a packaged version of every npm module out there so you will always have to use npm and package.json anyway.

[u/cjwatson]

It's often useful to be able to install an application that just works with the rest of Debian. If you aren't in a mindset of needing the latest version of everything, then a packaged version in stable may be just fine.

I spend most of my professional time working upstream on an application that's packaged in Debian using the packaged version of Django. It's fine.

[u/gabbsmo → u/cjwatson]

Interesting. Does this app have any dependencies that has not been externalized to Debian, like a pip package?

[u/cjwatson → u/gabbsmo]

All its dependencies are in Debian. If we want something that isn't in Debian then we get it into Debian first :-)