Has append support for npm config been considered? Global allow-scripts use case.

[spinualexandru]

🏷️ Discussion Type

Question

Body

Hello,

When using globally installed programs via npm, we're sometimes asked to allow their scripts by adding them to allow-scripts.

I usually do that with
npm config set allow-scripts packageOne,packageTwo --location=user

However, to preserve existing approvals, I first need to run npm config get allow-scripts, copy the current list and add the new packages before setting it again or I do in fish npm config set allow-scripts (npm config get allow-scripts),myNewPackage --location=user

This is a minor inconvenience, but iit made me curious whether an append subcommand or flag has been considered. For example: npm config set <key> <value> --append or npm config append <key> <value>

I looked at npm/cli#9457 and npm/cli#9469 which would explain the recommendation to use user-level allow-scripts. Has adding entries without replacing existing approvals been discussed or considered? Are there any design considerations behind the current approach or is this simply something that wasnt added yet?

Thanks!

[yashkhou]

There is a useful .npmrc mechanism here even though npm config set itself is replacement-oriented: npm's config-file format supports array values by repeating key[].

For a user-level config you can represent the approvals as:

allow-scripts[]=packageOne
allow-scripts[]=packageTwo
allow-scripts[]=myNewPackage

I tested that shape with npm 11.6.2 using an isolated userconfig; npm config get allow-scripts resolved it to packageOne,packageTwo.

So an append-style CLI command would still be useful ergonomically, but the underlying config format already has a non-destructive multi-value representation. Current npm docs also describe allow-scripts as a String that can be set multiple times and document the key[] array syntax for .npmrc.

Docs:
https://docs.npmjs.com/files/npmrc/
https://docs.npmjs.com/using-npm/config/#allow-scripts