Update mutate-fs for Debian packaging

[arunasank]

No description provided.

[arunasank]

👋 @isaacs

This PR is to enable this package to work on the Debian distribution. The Debian project uses a package pinned at a single version throughout the distribution, and currently they're using a version of mutate-fs 2.1.0. Owing to the way in which ^ ranges work for packages, semver won't automatically update a package at ^1.0.2 to 2.1.0, even though the dependency has been updated.

cc/ @freenerd

[isaacs]

I am not opposed, but the reasoning confuses me. Why aren’t you installing npm deps with npm? Pinning lib versions system wide for dev dependencies is a strange and bad thing to do in most cases.

[arunasank]

I am not opposed, but the reasoning confuses me. Why aren’t you installing npm deps with npm? Pinning lib versions system wide for dev dependencies is a strange and bad thing to do in most cases.

I think it makes sense for the Debian project. I am not sure of the full details of why this makes sense, but possibly also related to a language/framework dependence.

cc/ @pravi

[pravi]

We want every software available via system package manager ie, apt. We don't want people to have to dig details of what language a particular software is written. Generally our aim is to package only the modules required for a particular software like gitlab or diaspora.

In this particular case, ignore-walk is a dependency of npm. We want apt install npm to work using apt alone without depending on any external service. That is for the strict requirement of main section. Sometimes we do use npm or gem when we are unable to package everything for apt. But such packages have to be in contrib section.

We could have used mutate-fs 1.x but we did not realise 2.x would create issues. It was a mistake from our side. We could switch back to 1.x via a hack (some times we do that as a last resort) but it would be easier if ignore-walk could use mutate-fs 2.x.

I know this comes as a shock to most nodejs developers but it just means more work for us to ensure compatibility and send pull requests like this to be on the same page as upstream. Since we are talking about Free Software, we can do this ourselves even if some upstreams refuse to cooperate.

Ultimately the aim is to provide all software using a single package manager and build and maintain everything via same infrastructure. These pull requests are the cost we need to bear to achieve that goal. Hope you got the idea even if you disagree with it.

[isaacs]

In this particular case, ignore-walk is a dependency of npm. We want apt install npm to work using apt alone without depending on any external service.

Ok. So, why not do like npm itself does, in 100% of its supported distribution channels, and bundle the deps in the node_modules folder? That's not a hack or workaround, and it means that you're less dependent on any third-party service.

Since mutate-fs is only a development dependency, you could also just not include it at all. Nothing uses it at runtime, that's what devDependency means. It's just for development and testing.

[pravi]

Yes, we recently started bundling dependencies in node_modules, but ignore-walk was done before we adopted that strategy. Since we want to be able to update dependencies frequently, running tests helps us when dependency changes introduces breaking changes. It is not mandatory to run tests, but it gives us more confidence as we sometimes diverges or want to diverge from upstream in dependeny versions.

But we don't want to bundle any modules multiple times as we prefer to support a single version on any module, as much as possible (we sometimes offer multiple versions as a last resort option). We are willing to take up the extra effort of ensuring compatibility as opposed to bundling multiple versions. Its two different philosophies.

[wraithgar]

#26