# Is a update for the npm package a possibility?

**URL:** <https://discourse.elm-lang.org/t/is-a-update-for-the-npm-package-a-possibility/9358>\
**Category:** Learn\
**Created:** [September 27, 2023, 5:12pm UTC](https://discourse.elm-lang.org/t/is-a-update-for-the-npm-package-a-possibility/9358 "2023-09-27T17:12:56Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Carsten\_Konig](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/carsten_konig/32/4063_2.png) [@Carsten\_Konig](https://discourse.elm-lang.org/u/Carsten_Konig)\
**Post date:** [September 27, 2023, 5:12pm UTC](https://discourse.elm-lang.org/t/is-a-update-for-the-npm-package-a-possibility/9358/1 "2023-09-27T17:12:56Z")

</div>

Hi,

first let me say sorry if this issue was answered lately - while I’m a regular Elm user I’m not really following the community here or elsewhere on a regular basis.

In the last couple of months the npm packages has seen really quite a few bit/security-rot.  
I usually install elm and elm-format via `npm install --save-dev` and our CI has the usual dependency scanners ready … which means that I have to _dismiss_ quite a few critical or high alerts in the reports and honestly: it really rubs me the wrong way (it looks pathetic and it shows in the audits).

Sure I could build me a docker-image with the binaries preinstalled and circumvent this but that departs somewhat between our usual dev- and build-setup and this would be a last resort for me.

How are others here coping with this and is there _any_ chance that someone with the needed access-rights would go and do some maintenance on the package?

Fun thing is that `npm audit` wants to revert to `0.19.0` as this has fewer of the broken/insecure package-dependencies 😓

---

<div class="post-metadata">

**Author:** ![lydell](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/lydell/32/178_2.png) [@lydell](https://discourse.elm-lang.org/u/lydell)\
**Post date:** [September 27, 2023, 6:55pm UTC](https://discourse.elm-lang.org/t/is-a-update-for-the-npm-package-a-possibility/9358/2 "2023-09-27T18:55:30Z")

</div>

Last year, me and @supermario worked on updating it, initially with buy-in from Evan. But in the end, he didn’t want to do it. Here’s the pull request: [Free the npm package from third party dependencies by lydell · Pull Request #2287 · elm/compiler · GitHub](https://github.com/elm/compiler/pull/2287)

However, that work still resulted in the [@lydell/elm](https://www.npmjs.com/package/@lydell/elm) npm package, which you can install right now:

```auto
npm install @lydell/elm

```

There’s also the [elm-tooling](https://elm-tooling.github.io/elm-tooling-cli/) CLI which is yet an alternative.

---

<div class="post-metadata">

**Author:** ![kanishka](https://avatars.discourse-cdn.com/v4/letter/k/3e96dc/32.png) [@kanishka](https://discourse.elm-lang.org/u/kanishka)\
**Post date:** [September 27, 2023, 9:26pm UTC](https://discourse.elm-lang.org/t/is-a-update-for-the-npm-package-a-possibility/9358/3 "2023-09-27T21:26:13Z")

</div>

The last time I looked (~6 months ago), I think only elm-review actually needs node and everything else (if you substitute elm-test-rs for elm-test) could hypothetically bypass using node/npm as fancy downloader for executables, and obviate the need to keep up with the dumpster fire in the future.

---

<div class="post-metadata">

**Author:** ![wolfadex](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/wolfadex/32/2461_2.png) [@wolfadex](https://discourse.elm-lang.org/u/wolfadex)\
**Post date:** [September 28, 2023, 12:34am UTC](https://discourse.elm-lang.org/t/is-a-update-for-the-npm-package-a-possibility/9358/4 "2023-09-28T00:34:51Z")

</div>

There’s also [elm-watch](https://github.com/lydell/elm-watch) which uses Node

---

<div class="post-metadata">

**Author:** ![marcw](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/marcw/32/4937_2.png) [@marcw](https://discourse.elm-lang.org/u/marcw)\
**Post date:** [October 2, 2023, 6:28am UTC](https://discourse.elm-lang.org/t/is-a-update-for-the-npm-package-a-possibility/9358/5 "2023-10-02T06:28:43Z")

</div>

Right now, elm-test-rs needs either [node or deno](https://github.com/mpizenberg/elm-test-rs#deno-runtime) to actually run the tests.

But the scary installation with npm could be avoided.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex035/uploads/elm_lang/original/1X/50a05e53677a2c3b47776d7abd0f113eb50193a1.png) [@system](https://discourse.elm-lang.org/u/system)\
**Post date:** [October 12, 2023, 6:29am UTC](https://discourse.elm-lang.org/t/is-a-update-for-the-npm-package-a-possibility/9358/6 "2023-10-12T06:29:07Z")

</div>

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.