Skip to content

feat: namespace install-script approval commands under npm install-scripts (#9629)#9634

Closed
owlstronaut wants to merge 1 commit into
release/v11from
backport/v11/9629
Closed

feat: namespace install-script approval commands under npm install-scripts (#9629)#9634
owlstronaut wants to merge 1 commit into
release/v11from
backport/v11/9629

Conversation

@owlstronaut

Copy link
Copy Markdown
Contributor

Backport of #9629 to release/v11.

The automated backport failed to cherry-pick cleanly (conflicts in lib/commands/rebuild.js and the npm.js/smoke-tests usage snapshots). Resolved manually:

  • rebuild.js: kept the v11 advisory wording and applied only the npm install-scripts command rename + npm install-scripts ls remediation from feat: namespace install-script approval commands under npm install-scripts #9629.
  • Usage snapshots: regenerated for the v11 command set (which still has shrinkwrap/star/stars/unstar and no patch) with install-scripts inserted, verified against npm's usage wrap formatter at every column width.

Closes #9545 on the v11 line.
Follow-up from RFC npm/rfcs#868.

…ripts (#9629)

Add a namespaced `npm install-scripts` command that groups the
install-script approval operations, following npm's existing `npm cache
<cmd>` / `npm token <cmd>` convention:

- `npm install-scripts approve <pkg>... | --all`
- `npm install-scripts deny <pkg>... | --all`
- `npm install-scripts ls` (list packages with unreviewed install
scripts)

The shipped `npm approve-scripts` and `npm deny-scripts` commands keep
working as aliases for `approve` and `deny`, so this is additive and
backwards compatible. The shared `AllowScriptsCmd` base now dispatches
through `runMode(mode, args)`; the standalone commands route through it
via `static verb`. The `--allow-scripts-pending` flag is only honored by
the commands that declare it, so the namespace lists exclusively through
`ls`.

Closes #9545
Follow-up from RFC npm/rfcs#868.

(cherry picked from commit 0c4dd41)
@owlstronaut owlstronaut requested review from a team as code owners June 24, 2026 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants