FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade npm to 11.16.0 · nodejs/node@b76bfcd · GitHub

deps: upgrade npm to 11.16.0 · nodejs/node@b76bfcd · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit b76bfcd

Browse files
npm-cli-bot
authored and
sxa
committed
deps: upgrade npm to 11.16.0
PR-URL: #63602 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
1 parent fe4540e commit b76bfcd

277 files changed

Lines changed: 7294 additions & 482 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/npm/docs/content/commands/npm-approve-scripts.md‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
---
2+
title: npm-approve-scripts
3+
section: 1
4+
description: Approve install scripts for specific dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm approve-scripts <pkg> [<pkg> ...]
11+
npm approve-scripts --all
12+
npm approve-scripts --allow-scripts-pending
13+
```
14+
15+
Note: This command is unaware of workspaces.
16+
17+
### Description
18+
19+
Manages the `allowScripts` field in your project's `package.json`, which
20+
records which of your dependencies are permitted to run install scripts
21+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
22+
sources). This command is the recommended way to maintain that field.
23+
24+
In the current release, this field is advisory: install scripts still run
25+
by default, but installs print a list of packages whose scripts have not
26+
been reviewed. A future release will block unreviewed install scripts.
27+
28+
There are three modes:
29+
30+
```bash
31+
npm approve-scripts <pkg> [<pkg> ...]
32+
npm approve-scripts --all
33+
npm approve-scripts --allow-scripts-pending
34+
```
35+
36+
`<pkg>` matches every installed version of that package. By default the
37+
command writes pinned entries (`pkg@1.2.3`), which keep their approval
38+
narrowed to the specific version you reviewed. Pass `--no-allow-scripts-pin` to write
39+
name-only entries that allow any future version.
40+
41+
`--all` approves every package with unreviewed install scripts in one go.
42+
43+
`--allow-scripts-pending` is read-only: it lists every package whose install scripts
44+
are not yet covered by `allowScripts`, without modifying `package.json`.
45+
46+
`approve-scripts` honours the asymmetric pin rule: if you re-approve a
47+
package whose installed version has changed, the existing pin is rewritten
48+
to track the new installed version. Multi-version statements
49+
(`pkg@1 || 2`) are left alone, since they likely capture intent that
50+
the command cannot infer. Existing `false` entries always win;
51+
`approve-scripts` will not silently re-allow a package you previously
52+
denied.
53+
54+
### Examples
55+
56+
```bash
57+
# Approve all currently-installed install scripts after reviewing them
58+
npm approve-scripts --all
59+
60+
# Approve specific packages, pinned to their installed version
61+
npm approve-scripts canvas sharp
62+
63+
# Approve name-only (any version of this package is allowed)
64+
npm approve-scripts --no-allow-scripts-pin canvas
65+
66+
# Preview which packages still need review
67+
npm approve-scripts --allow-scripts-pending
68+
```
69+
70+
### Configuration
71+
72+
#### `all`
73+
74+
* Default: false
75+
* Type: Boolean
76+
77+
When running `npm outdated` and `npm ls`, setting `--all` will show all
78+
outdated or installed packages, rather than only those directly depended
79+
upon by the current project.
80+
81+
82+
83+
#### `allow-scripts-pending`
84+
85+
* Default: false
86+
* Type: Boolean
87+
88+
List packages with install scripts that are not yet covered by the
89+
`allowScripts` policy, without modifying `package.json`. Only meaningful for
90+
`npm approve-scripts`.
91+
92+
93+
94+
#### `allow-scripts-pin`
95+
96+
* Default: true
97+
* Type: Boolean
98+
99+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
100+
`false` to write name-only entries that allow any version. Has no effect on
101+
`npm deny-scripts`, which always writes name-only entries regardless of this
102+
setting.
103+
104+
105+
106+
#### `json`
107+
108+
* Default: false
109+
* Type: Boolean
110+
111+
Whether or not to output JSON data, rather than the normal output.
112+
113+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
114+
saving them to your `package.json`.
115+
116+
Not supported by all npm commands.
117+
118+
119+
120+
### See Also
121+
122+
* [npm deny-scripts](/commands/npm-deny-scripts)
123+
* [npm install](/commands/npm-install)
124+
* [npm rebuild](/commands/npm-rebuild)
125+
* [package.json](/configuring-npm/package-json)

‎deps/npm/docs/content/commands/npm-ci.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,56 @@ like `npm view`
262262

263263

264264

265+
#### `allow-scripts`
266+
267+
* Default: ""
268+
* Type: String (can be set multiple times)
269+
270+
Comma-separated list of packages whose install-time lifecycle scripts
271+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
272+
dependencies) are allowed to run.
273+
274+
This setting is intended for one-off and global contexts: `npm exec`, `npx`,
275+
and `npm install -g`, where no project `package.json` is involved. For
276+
team-wide policy in a project, use the `allowScripts` field in
277+
`package.json` (which also supports explicit denials), or configure it in
278+
`.npmrc`. Passing `--allow-scripts` on the command line during a
279+
project-scoped `npm install`, `ci`, `update`, or `rebuild` is an error.
280+
281+
Each name is matched against a dependency's resolved identity, not against
282+
the package's self-reported name. `--ignore-scripts` and
283+
`--dangerously-allow-all-scripts` both override this setting.
284+
285+
286+
287+
#### `strict-allow-scripts`
288+
289+
* Default: false
290+
* Type: Boolean
291+
292+
If `true`, turn the install-script policy from a warning into a hard error:
293+
any dependency with install scripts not covered by `allowScripts` will fail
294+
the install instead of running with a notice.
295+
296+
Dependencies explicitly denied with `false` in `allowScripts` are always
297+
silently skipped; this setting only affects unreviewed entries.
298+
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
299+
setting.
300+
301+
302+
303+
#### `dangerously-allow-all-scripts`
304+
305+
* Default: false
306+
* Type: Boolean
307+
308+
If `true`, bypass the `allowScripts` policy entirely and run every
309+
dependency install script regardless of whether it was approved or denied.
310+
Intended as a migration escape hatch only; its use is strongly discouraged.
311+
`--ignore-scripts` still takes precedence over this setting.
312+
313+
314+
265315
#### `audit`
266316

267317
* Default: true

‎deps/npm/docs/content/commands/npm-deny-scripts.md‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
---
2+
title: npm-deny-scripts
3+
section: 1
4+
description: Deny install scripts for specific dependencies
5+
---
6+
7+
### Synopsis
8+
9+
```bash
10+
npm deny-scripts <pkg> [<pkg> ...]
11+
npm deny-scripts --all
12+
```
13+
14+
Note: This command is unaware of workspaces.
15+
16+
### Description
17+
18+
The companion command to [`npm approve-scripts`](/commands/npm-approve-scripts).
19+
Writes `false` entries into the `allowScripts` field of your project's
20+
`package.json`, recording that a dependency must not run install scripts
21+
even if a future version would otherwise be eligible.
22+
23+
In the current release, install scripts still run by default, so `deny-scripts`
24+
only affects how installs of denied packages are reported. A future release
25+
will block unreviewed install scripts and respect deny entries at install
26+
time.
27+
28+
```bash
29+
npm deny-scripts <pkg> [<pkg> ...]
30+
npm deny-scripts --all
31+
```
32+
33+
`<pkg>` matches every installed version of that package. Denies are always
34+
written name-only (`"pkg": false`), regardless of `--allow-scripts-pin`. Pinning a deny
35+
to a specific version would silently re-allow scripts for any other version
36+
of the same package, which defeats the purpose; the command picks the
37+
safer default for you.
38+
39+
`--all` denies every package with unreviewed install scripts.
40+
41+
If a `true` (pinned or name-only) entry exists for a package and you then
42+
deny it, the existing allow entries are removed so the name-only deny is
43+
unambiguous.
44+
45+
### Examples
46+
47+
```bash
48+
# Deny a specific package outright
49+
npm deny-scripts telemetry-pkg
50+
51+
# Deny everything that has install scripts and isn't already approved
52+
npm deny-scripts --all
53+
```
54+
55+
### Configuration
56+
57+
#### `all`
58+
59+
* Default: false
60+
* Type: Boolean
61+
62+
When running `npm outdated` and `npm ls`, setting `--all` will show all
63+
outdated or installed packages, rather than only those directly depended
64+
upon by the current project.
65+
66+
67+
68+
#### `allow-scripts-pending`
69+
70+
* Default: false
71+
* Type: Boolean
72+
73+
List packages with install scripts that are not yet covered by the
74+
`allowScripts` policy, without modifying `package.json`. Only meaningful for
75+
`npm approve-scripts`.
76+
77+
78+
79+
#### `allow-scripts-pin`
80+
81+
* Default: true
82+
* Type: Boolean
83+
84+
Write pinned (`pkg@version`) entries when approving install scripts. Set to
85+
`false` to write name-only entries that allow any version. Has no effect on
86+
`npm deny-scripts`, which always writes name-only entries regardless of this
87+
setting.
88+
89+
90+
91+
#### `json`
92+
93+
* Default: false
94+
* Type: Boolean
95+
96+
Whether or not to output JSON data, rather than the normal output.
97+
98+
* In `npm pkg set` it enables parsing set values with JSON.parse() before
99+
saving them to your `package.json`.
100+
101+
Not supported by all npm commands.
102+
103+
104+
105+
### See Also
106+
107+
* [npm approve-scripts](/commands/npm-approve-scripts)
108+
* [npm install](/commands/npm-install)
109+
* [package.json](/configuring-npm/package-json)

‎deps/npm/docs/content/commands/npm-exec.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,56 @@ the specified workspaces, and not on the root project.
158158

159159
This value is not exported to the environment for child processes.
160160

161+
#### `allow-scripts`
162+
163+
* Default: ""
164+
* Type: String (can be set multiple times)
165+
166+
Comma-separated list of packages whose install-time lifecycle scripts
167+
(`preinstall`, `install`, `postinstall`, and `prepare` for non-registry
168+
dependencies) are allowed to run.
169+
170+
This setting is intended for one-off and global contexts: `npm exec`, `npx`,
171+
and `npm install -g`, where no project `package.json` is involved. For
172+
team-wide policy in a project, use the `allowScripts` field in
173+
`package.json` (which also supports explicit denials), or configure it in
174+
`.npmrc`. Passing `--allow-scripts` on the command line during a
175+
project-scoped `npm install`, `ci`, `update`, or `rebuild` is an error.
176+
177+
Each name is matched against a dependency's resolved identity, not against
178+
the package's self-reported name. `--ignore-scripts` and
179+
`--dangerously-allow-all-scripts` both override this setting.
180+
181+
182+
183+
#### `strict-allow-scripts`
184+
185+
* Default: false
186+
* Type: Boolean
187+
188+
If `true`, turn the install-script policy from a warning into a hard error:
189+
any dependency with install scripts not covered by `allowScripts` will fail
190+
the install instead of running with a notice.
191+
192+
Dependencies explicitly denied with `false` in `allowScripts` are always
193+
silently skipped; this setting only affects unreviewed entries.
194+
`--ignore-scripts` and `--dangerously-allow-all-scripts` both override this
195+
setting.
196+
197+
198+
199+
#### `dangerously-allow-all-scripts`
200+
201+
* Default: false
202+
* Type: Boolean
203+
204+
If `true`, bypass the `allowScripts` policy entirely and run every
205+
dependency install script regardless of whether it was approved or denied.
206+
Intended as a migration escape hatch only; its use is strongly discouraged.
207+
`--ignore-scripts` still takes precedence over this setting.
208+
209+
210+
161211
### Examples
162212

163213
Run the version of `tap` in the local dependencies, with the provided arguments:

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL