grunt-call-npm

run npm commands (like install or update) from grunt.

This plugin is a fork of grunt-npm-command (archived repository).
Reason: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2

Due to changes in Node.js security defaults (April 2024), spawning npm processes without an explicit shell may fail or behave differently in certain environments.
This plugin explicitly supports the required configuration and keeps npm invocation predictable inside Grunt-based build pipelines.

Content

• Usage

  • Getting started guide
  • Usage and examples
  • When to use this plugin

• Developers

  • Testing grunt-call-npm
  • Code coverage of tests for grunt-call-npm
  • Build grunt-call-npm from scratch
  • NPM integration of grunt-call-npm
  • Frameworks used for testing, building, etc.
  • API of package grunt-call-npm

Changelog

Getting started

This guide assumes that you are already familiar with the use of npm and grunt.

This plugin is intended for users who already work with Grunt-based build processes. It does not aim to abstract npm itself, but to integrate npm commands cleanly into existing Grunt workflows.

The plugin can be installed using the following command:

npm install grunt-call-npm --save-dev

Once installed, the plugin can be loaded from within your Gruntfile:

grunt.loadNpmTasks("grunt-call-npm");

Set up the task configuration as described below (see usage) and run the task:

grunt call_npm

Of course, the task can be integrated into any more complex build process.

When to use this plugin

Use this plugin if your Grunt build needs to trigger npm commands as part of a reproducible workflow, for example:

• installing or updating dependencies in sub-packages
• preparing fixtures or test environments during a build
• synchronizing npm-based steps with other Grunt tasks

If you only need to run an occasional shell command, a generic exec task may be sufficient. This plugin is useful when npm invocation is a first-class part of your build logic.

Usage

The following examples assume that the Grunt plugin load-grunt-config is used.

Alternatively, the configuration can be integrated directly into the Gruntfile.js.

// file call_npm.js
module.exports = function ( grunt, options ) {
  return {
    options: {
      opts: {                     // options passed to Node.js 'child_process::spawn'
                                  // Note: this is a default option and can be omitted
        shell: true,              // required as of https://nodejs.org/en/blog/vulnerability/april-2024-security-releases-2
                                  // default: true
        quiet: true               // will execute 'npm help' silently
                                  // default: false
        // ...                    // any other option supported by 'child_process::spawn'
      }
    },
    always: {                     // target 'always' of Grunt multitask 'call_npm'
      options: {
        cmd:    "help",           // will run 'npm help'
        args:   [],               // arguments appended to 'npm help'
        cwd:    "./path/to/pkg",  // working directory of the npm command
        dryrun: true              // prints the command without executing it
        // opts: {...}            // overrides default 'opts' if defined
      }
    }
  };
};

For npm <command> and supported command-line arguments, see the npm documentation.