Heads up: npm v12 changes npm install defaults (targeted July 2026)

[Aditevil]

npm v12 (targeted July, 2026) is an upstream release that impacts how npm install behaves: dependency lifecycle scripts no longer run, Git and remote-URL dependencies no longer resolve, and npm-shrinkwrap.json support is removed.

You are affected if you install npm with apk add npm, or if you build on a Chainguard image that bundles npm. No action is required if your npm usage does not rely on these behaviors. If they do, test now with npm 11.16.0 or newer.

What's changing
These are upstream npm changes, not Chainguard-specific behavior. They affect you in two ways: when you install the Chainguard npm package with apk add npm, and when you build on a Chainguard image that bundles npm.

1. Dependency lifecycle scripts are off by default. npm install no longer runs preinstall, install, or postinstall scripts from dependencies unless you allow them. This also blocks native node-gyp rebuilds and the prepare scripts from Git, file, and link dependencies.
2. Git dependencies are off by default. npm install no longer resolves Git dependencies, direct or transitive, unless you allow them with --allow-git=all.
3. Remote-URL dependencies are off by default. npm install no longer resolves dependencies from remote URLs, such as HTTPS tarballs, unless you allow them with --allow-remote=all. The --allow-file and --allow-directory defaults do not change.
4. npm-shrinkwrap.json support is removed. The npm shrinkwrap command and the shrinkwrap config alias are removed. Any npm-shrinkwrap.json is ignored, both at a project root and inside dependency tarballs.

For more detail, see the official npm v12 announcement and the GitHub community discussion.
Let us know if you have any questions about how to navigate this.