@cryptotaxi247 / documentation-1
Code Commits Issues Pulls Sessions CI/CD
dependabot/npm_and_yarn/main/proc-log-7.0.0
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 125 lines 4.71 KB
Raw
1 ---
2 title: npm-approve-scripts
3 section: 1
4 description: Approve install scripts for specific dependencies
5 github_repo: npm/cli
6 github_branch: latest
7 github_path: docs/lib/content/commands/npm-approve-scripts.md
8 redirect_from:
9 - /cli-commands/approve-scripts
10 - /cli-commands/npm-approve-scripts
11 - /cli-documentation/approve-scripts
12 - /cli-documentation/cli-commands/approve-scripts
13 - /cli-documentation/cli-commands/npm-approve-scripts
14 - /cli-documentation/commands/approve-scripts
15 - /cli-documentation/commands/npm-approve-scripts
16 - /cli-documentation/npm-approve-scripts
17 - /cli-documentation/v11/approve-scripts
18 - /cli-documentation/v11/cli-commands/approve-scripts
19 - /cli-documentation/v11/cli-commands/npm-approve-scripts
20 - /cli-documentation/v11/commands/approve-scripts
21 - /cli-documentation/v11/commands/npm-approve-scripts
22 - /cli-documentation/v11/npm-approve-scripts
23 - /cli/approve-scripts
24 - /cli/cli-commands/approve-scripts
25 - /cli/cli-commands/npm-approve-scripts
26 - /cli/commands/approve-scripts
27 - /cli/commands/npm-approve-scripts
28 - /cli/npm-approve-scripts
29 - /cli/v11/approve-scripts
30 - /cli/v11/cli-commands/approve-scripts
31 - /cli/v11/cli-commands/npm-approve-scripts
32 - /cli/v11/commands/approve-scripts
33 - /cli/v11/npm-approve-scripts
34 - /commands/approve-scripts
35 - /commands/npm-approve-scripts
36 ---
37
38 ### Synopsis
39
40 ```bash
41 npm approve-scripts <pkg> [<pkg> ...]
42 npm approve-scripts --all
43 npm approve-scripts --allow-scripts-pending
44 ```
45
46 Note: This command is unaware of workspaces.
47
48 ### Description
49
50 Manages the `allowScripts` field in your project's `package.json`, which records which of your dependencies are permitted to run install scripts (`preinstall`, `install`, `postinstall`, and `prepare` for non-registry sources). This command is the recommended way to maintain that field.
51
52 In the current release, this field is advisory: install scripts still run by default, but installs print a list of packages whose scripts have not been reviewed. A future release will block unreviewed install scripts.
53
54 There are three modes:
55
56 ```bash
57 npm approve-scripts <pkg> [<pkg> ...]
58 npm approve-scripts --all
59 npm approve-scripts --allow-scripts-pending
60 ```
61
62 `<pkg>` matches every installed version of that package. By default the command writes pinned entries (`pkg@1.2.3`), which keep their approval narrowed to the specific version you reviewed. Pass `--no-allow-scripts-pin` to write name-only entries that allow any future version.
63
64 `--all` approves every package with unreviewed install scripts in one go.
65
66 `--allow-scripts-pending` is read-only: it lists every package whose install scripts are not yet covered by `allowScripts`, without modifying `package.json`.
67
68 `approve-scripts` honours the asymmetric pin rule: if you re-approve a package whose installed version has changed, the existing pin is rewritten to track the new installed version. Multi-version statements (`pkg@1 || 2`) are left alone, since they likely capture intent that the command cannot infer. Existing `false` entries always win; `approve-scripts` will not silently re-allow a package you previously denied.
69
70 ### Examples
71
72 ```bash
73 # Approve all currently-installed install scripts after reviewing them
74 npm approve-scripts --all
75
76 # Approve specific packages, pinned to their installed version
77 npm approve-scripts canvas sharp
78
79 # Approve name-only (any version of this package is allowed)
80 npm approve-scripts --no-allow-scripts-pin canvas
81
82 # Preview which packages still need review
83 npm approve-scripts --allow-scripts-pending
84 ```
85
86 ### Configuration
87
88 #### `all`
89
90 - Default: false
91 - Type: Boolean
92
93 When running `npm outdated` and `npm ls`, setting `--all` will show all outdated or installed packages, rather than only those directly depended upon by the current project.
94
95 #### `allow-scripts-pending`
96
97 - Default: false
98 - Type: Boolean
99
100 List packages with install scripts that are not yet covered by the `allowScripts` policy, without modifying `package.json`. Only meaningful for `npm approve-scripts`.
101
102 #### `allow-scripts-pin`
103
104 - Default: true
105 - Type: Boolean
106
107 Write pinned (`pkg@version`) entries when approving install scripts. Set to `false` to write name-only entries that allow any version. Has no effect on `npm deny-scripts`, which always writes name-only entries regardless of this setting.
108
109 #### `json`
110
111 - Default: false
112 - Type: Boolean
113
114 Whether or not to output JSON data, rather than the normal output.
115
116 - In `npm pkg set` it enables parsing set values with JSON.parse() before saving them to your `package.json`.
117
118 Not supported by all npm commands.
119
120 ### See Also
121
122 - [npm deny-scripts](/cli/v11/commands/npm-deny-scripts)
123 - [npm install](/cli/v11/commands/npm-install)
124 - [npm rebuild](/cli/v11/commands/npm-rebuild)
125 - [package.json](/cli/v11/configuring-npm/package-json)