Version pinning for external packages

General
1

Hi, all. First post here, searched for similar questions, didn't find any.

I am interested in version pinning for external packages (those in Setup tab of Function node).
Tried to use "package@version" notation, in a losing effort.
Is there a way to pin/fix version of external package?

  1. Sometimes "current version" is not a perfect solution.
  2. It's not very clear, what version I get if I import flow on fresh installation.
  3. NPM registry is not the safest supply chain on the planet.
  4. It can be compliance issue (itsec people hate when versions not nailed down)
2

If you are using the palette manager in the Editor then that is designed to be as simple and robust to use as possible I believe. If you want to do something outside its features, you will need a command line on the Node-RED server. From there, go to your Node-RED userDir (usually ~/.node-red) and you can then use standard npm commands and/or edit your package.json file to pin versions as needed.

Just note that I think that if you later update something from the palette manager, I don't know whether it simply updates to the latest or whether it respects your package.json - you may wish to check that.

1 Like
3

It will update to the latest.

2 Likes
4

So that means that you always need to use the command line.

1 Like
5

Thanks, all.
Looks like workaround falls on me.

6

What workaround, and in what way does it fail?

7

Anyone can suggest improvements. There is a category on this forum for feature requests.

Of course, developer time for core changes is very limited and so code is always welcomed once a feature is agreed on.

8

Not "fail", "falls". Like "responsibility falls on me" :slight_smile:
Workaround will be in form of a script doing npm install inside the container.

9

Yeah, I am not very good at js/ts right now (backend background), so I won't be bothering core devs with a feature request, until I have a quality PR to back it )

I think I will return to this question in the future.

1 Like
10

The great thing about Node-RED is that it can do pretty much anything if you want to authorise it. :smile:

So you could have a flow that runs the command line for you.

1 Like
11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.