From 9acd3b00547f196975baf069690b8e77562b1e09 Mon Sep 17 00:00:00 2001 From: Prayag Date: Tue, 14 Jul 2026 08:05:40 +0530 Subject: [PATCH 1/2] docs: mention lifecycle script blocking in npm 12 release notes --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index da431409546d5..cfa83fbab4b06 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -32,6 +32,7 @@ * allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies. * root \`preinstall\` now runs before dependencies are installed. * unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning. +* lifecycle scripts not covered by `allowScripts` are now blocked by default instead of executing with a warning. Projects relying on package lifecycle scripts may need to explicitly allow those scripts in their configuration. ### Chores * [`b77b532`](https://github.com/npm/cli/commit/b77b5321bd6dc8d4c028b89f3e4bc9c9a2209f8f) [#9735](https://github.com/npm/cli/pull/9735) remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot) From 601e107c67e0b92cfd05e3e24ae8fd812dbdb48e Mon Sep 17 00:00:00 2001 From: Prayag Date: Tue, 14 Jul 2026 08:20:45 +0530 Subject: [PATCH 2/2] docs: clarify allowScripts configuration options --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cfa83fbab4b06..97d70cdcc6f3b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -32,7 +32,7 @@ * allow-git and allow-remote now default to "none"; set them to "all" (or "root") to install git or user-supplied tarball-URL dependencies. * root \`preinstall\` now runs before dependencies are installed. * unknown configs in .npmrc, unknown CLI flags, abbreviated flags, and single-hyphen multi-char shorthands now throw instead of warning. -* lifecycle scripts not covered by `allowScripts` are now blocked by default instead of executing with a warning. Projects relying on package lifecycle scripts may need to explicitly allow those scripts in their configuration. +* Lifecycle scripts not covered by `allowScripts` are now blocked by default instead of executing with a warning. To allow them for project installs, add entries to `package.json#allowScripts` via `npm install-scripts approve`. For global installs, use the `--allow-scripts` flag or set `allow-scripts` in `.npmrc`. ### Chores * [`b77b532`](https://github.com/npm/cli/commit/b77b5321bd6dc8d4c028b89f3e4bc9c9a2209f8f) [#9735](https://github.com/npm/cli/pull/9735) remove pre-release mode from npm 12 and workspaces (#9735) (@reggi, @Copilot)