# Allow more flexible installation via the palette manager + maybe a breaking change in the Editor?

**URL:** <https://discourse.nodered.org/t/allow-more-flexible-installation-via-the-palette-manager-maybe-a-breaking-change-in-the-editor/102113>\
**Category:** Feature Requests\
**Created:** [9 November 2026 17:28 UTC](https://discourse.nodered.org/t/allow-more-flexible-installation-via-the-palette-manager-maybe-a-breaking-change-in-the-editor/102113 "2026-11-09T17:28:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [9 November 2026 17:28 UTC](https://discourse.nodered.org/t/allow-more-flexible-installation-via-the-palette-manager-maybe-a-breaking-change-in-the-editor/102113/1 "2026-11-09T17:28:14Z")

</div>

Came across a bit of an issue while trying to test a new major version of UIBUILDER.

I need to do a bunch of install tests to make sure that installations are as robust as possible and that there are no strange timing or race conditions.

But to do that, I think I need to be able to use the palette manage to do the install the same way as a user would?

So my request would be the ability to be able to use _any_ valid npm package definition string including local paths and remote github including branches.

If there is an alternative way of doing this that uses the same process as the palette manager, I'm all ears. 😃

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [10 November 2026 12:01 UTC](https://discourse.nodered.org/t/allow-more-flexible-installation-via-the-palette-manager-maybe-a-breaking-change-in-the-editor/102113/2 "2026-11-10T12:01:44Z")

</div>

So, as a temporary workaround, I've built this flow to use the admin API to install the local package:

```flows
[{"id":"f1a0c0de03","type":"inject","z":"f1a0c0de01","name":"Install from folder","props":[{"p":"modulePath","v":"/src/node-red-contrib-uibuilder","vt":"str"}],"repeat":"","crontab":"","once":false,"onceDelay":0.1,"topic":"","x":120,"y":120,"wires":[["f1a0c0de04"]]},{"id":"f1a0c0de04","type":"function","z":"f1a0c0de01","name":"Build JSON request","func":"const modulePath = msg.modulePath;\nif (!modulePath) {\n node.error('msg.modulePath is required', msg);\n return null;\n}\n\nmsg.payload = { module: modulePath };\nmsg.headers = {};\n\nconst base = (env.get('NR_ADMIN_URL') || 'http://localhost:1885').replace(/\\/+$/, '');\nmsg.method = 'POST';\nmsg.url = `${base}/nodes`;\n\nconst token = env.get('NR_ADMIN_TOKEN');\nif (token) {\n msg.headers.Authorization = 'Bearer ' + token;\n}\n\nnode.status({ fill: 'blue', shape: 'ring', text: 'installing...' });\nreturn msg;","outputs":1,"timeout":0,"noerr":0,"initialize":"","finalize":"","libs":[],"x":330,"y":120,"wires":[["f1a0c0de08"]]},{"id":"f1a0c0de08","type":"http request","z":"f1a0c0de01","name":"POST /nodes","method":"use","ret":"obj","paytoqs":"ignore","url":"","tls":"","persist":false,"proxy":"","insecureHTTPParser":false,"authType":"","senderr":false,"headers":[],"x":580,"y":120,"wires":[["f1a0c0de09"]]},{"id":"f1a0c0de09","type":"function","z":"f1a0c0de01","name":"Format result","func":"const body = msg.payload;\n\nif (msg.statusCode === 200 && body && body.name) {\n node.status({ fill: 'green', shape: 'dot', text: body.name + '@' + body.version });\n msg.payload = {\n installed: body.name,\n version: body.version,\n nodes: (body.nodes || []).map(n => `${n.id} [${(n.types || []).join(', ')}]`)\n };\n return msg;\n}\n\nconst hints = {\n 401: 'Not authorised - set NR_ADMIN_TOKEN to a valid bearer token',\n 404: 'Not found - check the URL / httpAdminRoot, and that palette editing is enabled'\n};\n\nnode.status({ fill: 'red', shape: 'ring', text: 'failed (' + msg.statusCode + ')' });\nmsg.payload = {\n error: true,\n status: msg.statusCode,\n hint: hints[msg.statusCode],\n detail: body\n};\nreturn msg;","outputs":1,"timeout":0,"noerr":0,"initialize":"","finalize":"","libs":[],"x":750,"y":120,"wires":[["f1a0c0de0a"]]},{"id":"f1a0c0de0a","type":"debug","z":"f1a0c0de01","name":"Install result","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"payload","targetType":"msg","statusVal":"","statusType":"auto","x":910,"y":120,"wires":[]}]

```

However, I'm not sure whether something has changed with Node-RED v5.0.9?

Previously, an Editor plugin would definitely run BEFORE any node Editor code is run. This no longer seems to be the case, my Editor plugin is running AFTER which is very much messing things up.

Not sure if this is something I've done in my code or whether something has changed in Node-RED?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [12 November 2026 09:40 UTC](https://discourse.nodered.org/t/allow-more-flexible-installation-via-the-palette-manager-maybe-a-breaking-change-in-the-editor/102113/3 "2026-11-12T09:40:02Z")

</div>

Hi @TotallyInformation

We have generally held back from supporting essentially full access to all npm options in the palette manager for sake of usability and security. It is a fairly niche requirement to install nodes from arbitrary locations on disk - and comes with a _lot_ of security concerns around effectively given access to the whole filesystem unless careful controls are put in place.

One alternative is to use `npm pack` to create a tgz which the editor _does_ allow you to upload and install.

We could consider a 'developer-only' settings flag that would relax a lot of the security checks we have that validates the requests being passed to npm.

---

<div class="post-metadata">

**Author:** ![gregorius](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gregorius/32/73816_2.png) [@gregorius](https://discourse.nodered.org/u/gregorius)\
**Post date:** [12 November 2026 10:04 UTC](https://discourse.nodered.org/t/allow-more-flexible-installation-via-the-palette-manager-maybe-a-breaking-change-in-the-editor/102113/4 "2026-11-12T10:04:52Z")

</div>

> [@knolleary](#):
>
> It is a fairly niche requirement to install nodes from arbitrary locations on disk

It's something I do all the time since I want to shorten my development and testing time for node red node packages. So I'm constantly reinstalling node packages - with random version numbers so that NR thinks it's a node package upgrade.

I've codified that process with the help of the [nodedev package](https://flows.nodered.org/node/@gregoriusrippenstein/node-red-contrib-nodedev) so that I just end up pressing buttons to reinstall changes to my node packages into NR - inside the NR editor, no external editor required.

> [@knolleary](#):
>
> One alternative is to use `npm pack` to create a tgz

That's exactly what the NpmTarBall and NodeRedInstall nodes of the nodedev package do.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [12 November 2026 11:29 UTC](https://discourse.nodered.org/t/allow-more-flexible-installation-via-the-palette-manager-maybe-a-breaking-change-in-the-editor/102113/5 "2026-11-12T11:29:45Z")

</div>

> [@knolleary](#):
>
> We have generally held back from supporting essentially full access to all npm options in the palette manager for sake of usability and security

I understand.

Though, of course, I've already found and posted a work-around so the security part would already be an issue in any case.

> [@knolleary](#):
>
> It is a fairly niche requirement to install nodes from arbitrary locations on disk

I guess that depends on the use-case. And perhaps people's lack of knowledge about how npm works limits the requests as much as anything.

> [@knolleary](#):
>
> and comes with a _lot_ of security concerns around effectively given access to the whole filesystem unless careful controls are put in place.

True of course. Though actually I believe quite controllable. To be honest, the main use-case for this being local development, it would probably be sensible to lock down to the same device as the server for the folders. But agree this is more work.

> [@knolleary](#):
>
> One alternative is to use `npm pack` to create a tgz which the editor _does_ allow you to upload and install.

Yes, I saw that but it requires an extra pack step every time you want to do an updated test and locks the code into an install file which looses the advantages of using a folder install where you still have easy access to everything. Also noting that the use of resource files for the Editor code means that rapid development for the Editor often does not need a node-red restart. Using a packed file would negate that advantage.

> [@knolleary](#):
>
> We could consider a 'developer-only' settings flag that would relax a lot of the security checks we have that validates the requests being passed to npm.

Hmm, that is an interesting option. I suspect quite a few people would like that.

Thanks for responding Nick. I suspect you have more pressing things to deal with given the recent influx of PR's and stuff. So happy to leave this at the bottom of the queue since we have a workaround that isn't too horrible.

> [@gregorius](#):
>
> I've codified that process with the help of the [nodedev package](https://flows.nodered.org/node/@gregoriusrippenstein/node-red-contrib-nodedev) so that I just end up pressing buttons to reinstall changes to my node packages into NR - inside the NR editor, no external editor required.

And see the flow I posted a couple of days ago. It simply uses the admin API to add or remove a package programatically.