# Version pinning for external packages

**URL:** <https://discourse.nodered.org/t/version-pinning-for-external-packages/94982>\
**Category:** General\
**Tags:** external-package\
**Created:** [29 January 2025 12:07 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982 "2025-01-29T12:07:44Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bergstein](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bergstein/32/98428_2.png) [@Bergstein](https://discourse.nodered.org/u/Bergstein)\
**Post date:** [29 January 2025 12:07 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/1 "2025-01-29T12:07:44Z")

</div>

Hi, all. First post here, searched for similar questions, didn't find any.

I am interested in version pinning for external packages (those in Setup tab of Function node).  
Tried to use "package@version" notation, in a losing effort.  
Is there a way to pin/fix version of external package?

1. Sometimes "current version" is not a perfect solution.
2. It's not very clear, what version I get if I import flow on fresh installation.
3. NPM registry is not the safest supply chain on the planet.
4. It can be compliance issue (itsec people hate when versions not nailed down)

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 January 2025 13:18 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/2 "2025-01-29T13:18:58Z")

</div>

If you are using the palette manager in the Editor then that is designed to be as simple and robust to use as possible I believe. If you want to do something outside its features, you will need a command line on the Node-RED server. From there, go to your Node-RED userDir (usually `~/.node-red`) and you can then use standard `npm` commands and/or edit your `package.json` file to pin versions as needed.

Just note that I think that if you later update something from the palette manager, I don't know whether it simply updates to the latest or whether it respects your package.json - you may wish to check that.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [29 January 2025 13:29 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/3 "2025-01-29T13:29:37Z")

</div>

> [@TotallyInformation](#):
>
> if you later update something from the palette manager, I don't know whether it simply updates to the latest or whether it respects your package.json

It will update to the latest.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [29 January 2025 13:30 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/4 "2025-01-29T13:30:09Z")

</div>

So that means that you always need to use the command line.

---

<div class="post-metadata">

**Author:** ![Bergstein](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bergstein/32/98428_2.png) [@Bergstein](https://discourse.nodered.org/u/Bergstein)\
**Post date:** [30 January 2025 06:43 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/5 "2025-01-30T06:43:59Z")

</div>

Thanks, all.  
Looks like workaround falls on me.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [30 January 2025 08:55 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/6 "2025-01-30T08:55:44Z")

</div>

> [@Bergstein](#):
>
> Looks like workaround falls on me.

What workaround, and in what way does it fail?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [30 January 2025 09:46 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/7 "2025-01-30T09:46:21Z")

</div>

Anyone can suggest improvements. There is a category on this forum for feature requests.

Of course, developer time for core changes is very limited and so code is always welcomed once a feature is agreed on.

---

<div class="post-metadata">

**Author:** ![Bergstein](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bergstein/32/98428_2.png) [@Bergstein](https://discourse.nodered.org/u/Bergstein)\
**Post date:** [30 January 2025 10:41 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/8 "2025-01-30T10:41:40Z")

</div>

Not "fail", "falls". Like "responsibility falls on me" 🙂  
Workaround will be in form of a script doing npm install inside the container.

---

<div class="post-metadata">

**Author:** ![Bergstein](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bergstein/32/98428_2.png) [@Bergstein](https://discourse.nodered.org/u/Bergstein)\
**Post date:** [30 January 2025 10:44 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/9 "2025-01-30T10:44:27Z")

</div>

Yeah, I am not very good at js/ts right now (backend background), so I won't be bothering core devs with a feature request, until I have a quality PR to back it )

I think I will return to this question in the future.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [30 January 2025 12:40 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/10 "2025-01-30T12:40:31Z")

</div>

The great thing about Node-RED is that it can do pretty much anything if you want to authorise it. 😄

So you could have a flow that runs the command line for you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [13 February 2025 12:40 UTC](https://discourse.nodered.org/t/version-pinning-for-external-packages/94982/11 "2025-02-13T12:40:58Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.