install

Additional install commands

macOS

Homebrewverified · 100%

brew install flow

local Homebrew formula metadata

MacPortsverified · 94%

sudo port install flow

MacPorts ports tree · devel/flow/Portfile · source: api.github.com

Linux

Nixverified · 92%

nix profile install nixpkgs#flow

nixpkgs package indexes · pkgs/by-name/fl/flow/package.nix · source: api.github.com

Windows

Scoopverified · 92%

scoop install main/flow

Scoop official bucket manifest trees · bucket/flow.json · source: api.github.com

Windows Package Managerverified · 92%

winget install --id MadrasCheck.flow -e

Windows Package Manager source index · MadrasCheck.flow · source: cdn.winget.microsoft.com

overview

Package summary

Static type checker for JavaScript

Project links

Commands and aliases

flow

history

Project history and usage

Flow is Meta's static type checker and typed JavaScript dialect, distributed as the flow CLI and related npm tooling for checking JavaScript programs before runtime.

Project history

Facebook announced Flow in November 2014 as a new static type checker for JavaScript designed to find errors by analyzing programs without running them. The official repository describes Flow as a static typechecker for JavaScript and points users to flow.org for documentation.

Flow developed around a per-project configuration file, .flowconfig, and an npm-oriented setup through flow-bin. Its documentation also covers Babel and flow-remove-types for stripping Flow type annotations before publishing or running JavaScript.

Adoption history

Flow became closely associated with Facebook and React-era JavaScript projects, where static analysis was adopted to make large JavaScript codebases easier to maintain. The official docs include React-specific material and a dedicated guide for TypeScript users, reflecting Flow's long-running position in the JavaScript type-checking ecosystem.

In 2023, the Flow team published an official direction statement explaining that the project was focusing on Meta's internal use cases and would reduce broad open-source engagement, a notable shift in the project's adoption story.

How it is used

Typical usage is project-local: install flow-bin, add a flow script, run flow init to create .flowconfig, and run flow to type-check source files. Flow projects use type annotations in JavaScript source and a compiler such as Babel or flow-remove-types to remove those annotations for runtime JavaScript.

Flow also publishes parser tooling, including flow-parser, for packages that need to parse Flow-typed JavaScript directly.

Why package nerds care

Flow matters to package maintainers because it is both a CLI and a language-extension ecosystem: packages may ship Flow annotations, require stripping transforms, pin flow-bin versions, or expose libdefs and parser behavior that differ across releases.

Its history is also a useful contrast point for TypeScript in package metadata, because Flow-heavy projects often leave signals such as .flowconfig, flow-bin dev dependencies, and type-stripping build scripts.

Timeline

2014: Facebook announces Flow as a static type checker for JavaScript.
2010s: Flow is used with JavaScript package workflows through flow-bin, Babel, and flow-remove-types.
2023: The Flow team states a narrowed open-source direction focused on Meta's internal usage.
2026: Official docs show Flow continuing with releases, .flowconfig reference docs, React docs, and TypeScript migration guidance.

Related projects

Official docs and README connect Flow to flow-bin, flow-parser, flow-remove-types, Babel, React, and TypeScript migration guidance.

Sources

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for flow. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 6 platform targets.
Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: .flowconfigsrc/.flowconfig

executables

Installed executables

Command	Kind	Exposure	Note
`flow`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08

manager version0.321.0

manager updated2026-06-26

local dataok

upstreamcurrent

latest detectedv0.321.0

https://github.com/facebook/flow

okNo freshness warnings were generated.

install metadata

Package metadata

Package key	brew:flow
Version	0.321.0
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/flow
Homepage	https://flow.org/
Repository	https://github.com/facebook/flow
Upstream docs	https://flow.org/en/docs
License	MIT
Source archive	https://github.com/facebook/flow/archive/refs/tags/v0.321.0.tar.gz
Last updated	2026-06-26T01:11:25Z
Pulse	updated
Build dependencies	rust
Bottle	available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	flow
Version Scheme	0
Revision	0
Head Version	HEAD
Conflicts With	flow-cli
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

flow

nix profile install nixpkgs#flow

normalized package name match
Matched by: Flow

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/fl/flow/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

MacPorts95%

flow

sudo port install flow

normalized package name match
Matched by: Flow

MacPorts ports tree · api.github.com · MacPorts ports tree: devel/flow/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

Scoop95%

main/flow

scoop install main/flow

normalized package name match
Matched by: Flow

Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/flow.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

winget95%

MadrasCheck.flow

winget install --id MadrasCheck.flow -e

normalized package name match
Matched by: Flow

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: MadrasCheck.flow from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/flow.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated configuration and credential file locations
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install flow with Homebrew, MacPorts, Nix, scoop, winget