Skip to content

docs: document the allowScripts field in package.json #9817

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Nohgh wants to merge 1 commit into
base: latest
Choose a base branch
from
+26 −0
Open

docs: document the allowScripts field in package.json #9817

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions docs/lib/content/configuring-npm/package-json.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -542,6 +542,32 @@ The key is the lifecycle event, and the value is the command to run at that poin

See [`scripts`](/using-npm/scripts) to find out more about writing package scripts.

### allowScripts

The `allowScripts` field records which dependencies are permitted to run their `preinstall`, `install`, and `postinstall` scripts (and `prepare` for non-registry sources).
It is maintained with [`npm approve-scripts`](/commands/npm-approve-scripts) and [`npm deny-scripts`](/commands/npm-deny-scripts) rather than edited by hand.

Dependency install scripts are blocked by default.
Install commands silently skip lifecycle scripts for any dependency that does not have a matching entry in `allowScripts`, and end with a list of the packages whose scripts were skipped so you can review them.

Each entry can be either version-pinned or name-only:

```json
{
"allowScripts": {
"foo@1.2.3": true,
"baz": true,
"bar": false
}
}
```

* A version-pinned entry, e.g. `"pkg@1.2.3": true`, only applies to that specific version.
This is the default when approving a package with `npm approve-scripts`.
* A name-only entry, e.g. `"pkg": true`, applies to all current and future versions of that package.
Use the `--no-allow-scripts-pin` flag with `npm approve-scripts` to record an entry this way.
* `false` denies the package's scripts and always wins: re-approving a package does not silently override an existing denial, and denied packages are always recorded by name only, regardless of pinning.

### gypfile

If you have a binding.gyp file in the root of your package and you have not defined your own `install` or `preinstall` scripts, npm will default to building your module using node-gyp.
Expand Down