From 504747cb738feb9a75fe7bcf7cdd659b74499504 Mon Sep 17 00:00:00 2001 From: reggi Date: Mon, 3 Aug 2026 11:57:10 -0400 Subject: [PATCH] docs: document npm 12 install script blocking Add the omitted breaking-change note explaining that dependency lifecycle scripts are blocked by default and how to approve and run them.\n\nFixes #9750\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: f1b70f0a-a8ab-42ae-9f8a-5188817ce956 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 685391a6ec121..abdce3b0422a2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -51,6 +51,7 @@ * allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies. * root \`preinstall\` now runs before dependencies are installed. * unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning. (Unknown `.npmrc` configs still warn by default; opt into erroring with the new `strict-npmrc` config.) +* Dependency lifecycle scripts are now blocked by default unless allowed by the root package's `allowScripts` policy. After installing, run `npm install-scripts approve` to record approvals and `npm rebuild` to execute newly approved scripts. ### Chores * [`b77b532`](https://github.com/npm/cli/commit/b77b5321bd6dc8d4c028b89f3e4bc9c9a2209f8f) [#9735](https://github.com/npm/cli/pull/9735) remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot)