[rush] Rush/pnpm is bugging me about ignored build scripts after every `rush update`

[kgetz-arista]

Summary

After upgrading to the latest versions of Node, npm, Rush, and pnpm, every rush update results in a warning about ignored build scripts. The command referenced in the warning output is not quite correct, and running the command doesn't prevent the warning in the future.

Repro steps

Upgrade to the latest tool versions and run rush update.

Expected result: Business as usual

Actual result:

At the end of rush update, I see a message like this:

╭ Warning ─────────────────────────────────────────────────────────────────────────────────────────╮
│                                                                                                  │
│   Ignored build scripts: @arista/protobufjs@6.11.1, @nestjs/core@11.1.11,                        │
│   @parcel/watcher@2.5.1, @scarf/scarf@1.4.0, @sentry/cli@2.57.0, @swc/core@1.13.19,              │
│   @tree-sitter-grammars/tree-sitter-yaml@0.7.1, core-js-pure@3.47.0, esbuild@0.27.2,             │
│   less@4.5.1, protobufjs@7.4.0, protobufjs@7.5.4, tree-sitter-json@0.24.8, tree-sitter@0.21.1,   │
│   tree-sitter@0.22.4, unrs-resolver@1.9.0.                                                       │
│   Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.         │
│                                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯

Details

Running the command exactly as presented (pnpm approve-builds) doesn't work, as I don't have pnpm installed globally (it's installed through Rush). Running rush-pnpm approve-builds seems to work, and I can select all of these dependencies. However, this setting is seemingly not saved anywhere, because the next time I run rush update, I see the same message again. This has all become very annoying.

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
@microsoft/rush globally installed version?	5.165.0
rushVersion from rush.json?	5.165.0
pnpmVersion, npmVersion, or yarnVersion from rush.json?	pnpm@10.27.0
(if pnpm) useWorkspaces from pnpm-config.json?	true
Operating system?	Windows 11
Would you consider contributing a PR?	No
Node.js version (node -v)?	24.12.0

[iclanton]

Looks like we need to augment rush-pnpm approve-builds to update common/config/rush/pnpm-config.json. In the meantime, you can manually list the approved packages in the "globalOnlyBuiltDependencies" property and forbidden packages in the "globalNeverBuiltDependencies" property in common/config/rush/pnpm-config.json.

[kgetz-arista]

@iclanton Okay great, thank you for the workaround.

[iclanton]

Mind opening an issue about the pnpm approve-builds thing?

[kgetz-arista]

Mind opening an issue about the pnpm approve-builds thing?

#5543