Skip to content

fix: suggest --allow-scripts for global installs in unreviewed-scripts warnings#9469

Merged
owlstronaut merged 4 commits into
npm:latestfrom
JamieMagee:jamimagee/global-allow-scripts-warning
Jun 3, 2026
Merged

fix: suggest --allow-scripts for global installs in unreviewed-scripts warnings#9469
owlstronaut merged 4 commits into
npm:latestfrom
JamieMagee:jamimagee/global-allow-scripts-warning

Conversation

@JamieMagee
Copy link
Copy Markdown
Contributor

The unreviewed-scripts warning told users to run npm approve-scripts, which fails on global installs and npx/exec because there's no project package.json to write to. The warnings now check npm.global and point global users at the --allow-scripts flag and the allow-scripts .npmrc setting instead.

Covers the install warning (reify-output), the rebuild advisory warning, and the strict-allow-scripts preflight error. Also updates the approve-scripts docs.

References

Fixes #9457

@JamieMagee JamieMagee requested review from a team as code owners June 2, 2026 18:53
Comment thread lib/commands/rebuild.js Outdated
@JamieMagee JamieMagee requested a review from ljharb June 2, 2026 23:57
Comment thread lib/commands/rebuild.js Outdated
Comment thread lib/utils/reify-output.js Outdated
Comment thread lib/utils/strict-allow-scripts-preflight.js Outdated
Comment thread lib/utils/strict-allow-scripts-preflight.js Outdated
@owlstronaut owlstronaut merged commit 6603b2c into npm:latest Jun 3, 2026
27 checks passed
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 3, 2026

🎉 Backport to release/v11 created: #9481

owlstronaut pushed a commit that referenced this pull request Jun 3, 2026
…s warnings (#9481)

Backport of #9469 to `release/v11`.

Co-authored-by: Jamie Magee <jamie.magee@gmail.com>
@JamieMagee JamieMagee deleted the jamimagee/global-allow-scripts-warning branch June 3, 2026 21:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Unreviewed-scripts warning suggests npm approve-scripts during global installs, where it can't work

3 participants