NPM dependencies

[sharifzadesina]

Why we can't have any NPM dependency in our custom template? I think this feature is required.

[LinusBorg]

Your question is not clear, can you provide more details?

[sharifzadesina]

@LinusBorg this is not question, this is almost requesting a required feature.
See this repo: https://github.com/elegantweb/nwjs-vue
Try to install it using vue init elegantweb/nwjs-vue
You will see it says: string module not found or something similar.
This is cause we can't have any npm dependency in our package.json file this means vue-cli doesn't run npm install over template.

[posva]

He wants to use custom packages in the meta.js https://github.com/elegantweb/nwjs-vue/blob/master/meta.js#L1

I remember it was for security reasons. We don't want a malicious template to mess up someone's computer because of a package they require

[sharifzadesina]

@posva Yes, exactly, but security reasons? really?
1- If anyone wants to mess up, he can do even with pure node.
2- I don't think people will run vue with administration privileges (sudo).
So the security is not good reason at all.

[posva]

😆 never make assumptions about what people will or will not do in security. People will always do what you expect less, especially dumb things like running a command with sudo when they shouldn't

[sharifzadesina]

@posva Yes, but security reason doesn't work here :D I think we have to add this feature, this is required.

[posva]

We'll come up with something for next version (see #589 ), but the current model of vue-cli makes this not secure