Emacs 30 already ships a package manager, so most additions are optional layers over a model that works without them.
Emacs 30 includes package.el, built-in use-package, and package-vc. Prefer GNU ELPA and NonGNU ELPA where possible; MELPA offers breadth but often tracks snapshots. A minimal declaration reads clearly:
(use-package org-modern
:ensure t
:hook (org-mode . org-modern-mode))use-package organizes loading and configuration; :ensure asks the package system to install. It is not itself a package manager. package-vc-install can install directly from version-control sources, and pinning a commit improves reproducibility.
Curated packages, and their status
Status is evidence, not a verdict. Mature software may need few commits; a dormant exporter coupled to fast-moving JavaScript deserves more caution than a tiny presentation helper.
| Package | Purpose | Beginner? | Vanilla alternative |
|---|---|---|---|
| org-roam | Nodes, backlinks, graph PKM | Later | IDs, links, search |
| Denote | Predictable file notes | After basics | Files, capture, IDs |
| org-modern | Visual styling | Optional | Org faces |
| org-super-agenda | Agenda grouping | Advanced | Custom block agendas |
| org-transclusion | Live transclusion | Advanced | Links / INCLUDE |
Modern completion, optionally
Built-in completion is enough. Vertico changes minibuffer presentation; Orderless adds flexible matching; Consult supplies richer search and navigation; Embark provides context actions; Corfu provides in-buffer popups. They can improve capture-target selection, heading navigation, and M-x, but they do not change Org's data model. Add one layer at a time and preserve standard command names in your notes.
Browser and mail capture
org-protocol registers org-protocol:// URLs and routes browser calls through emacsclient to handlers such as capture and store-link. It requires a running Emacs server and an operating-system URL-handler registration. URL-decode and inspect external inputs; a capture endpoint is an input boundary, not magic clipboard glue.
Notmuch and mu4e are external mail systems. Their Org link and capture integrations can store a stable message search or identifier beside action items. Never copy confidential message bodies into broadly synchronized notes by default. For RSS, capture the durable reference and your annotation, not an uncontrolled full-page scrape.
Presentations
Vanilla export produces Beamer or HTML. org-present offers a minimal in-Emacs mode but has seen little activity since 2024; org-reveal/ox-reveal exports to reveal.js but appears dormant since 2023. Use them only after testing against current dependencies. Do not make an important talk depend on an untested legacy pipeline.
Summary. use-package declares what to install and how to configure it; curated packages add PKM, styling, and queries at a cost. Browser and mail capture route external input through emacsclient, and vanilla export still handles presentations.
Exercises
- Basic: Use built-in completion to find a heading and note where the standard behavior is already sufficient.
- Practical: Install one cosmetic package such as `org-modern`, then disable it and confirm your files remain ordinary Org.
- Advanced: Create a browser capture route in a test profile, then threat-model its inputs: what could a crafted `org-protocol://` URL do?