← 返回日报
略读 预计 2 分钟

Upcoming breaking changes for NPM v12

摘要

npm v12 将于 2026 年 7 月发布，将把 npm install 行为从自动运行改为需显式 opt-in：allowScripts 默认 off，npm install 将不再执行依赖包的 preinstall/install/postinstall 脚本（包括未指定脚本的 native node-gyp 构建），git/file/link 依赖的 prepare 脚本也同样被阻挡；--allow-git 默认关闭，将不再解析 Git 依赖（直接或传递），以避免.npmrc 覆盖 Git 可执行文件；--allow-remote 默认关闭，将不再解析远程 URL 依赖（如 https tarballs），但 --allow-file 和 --allow-directory 保持不变。所有变更在 npm 11.16.0 + 已启用警告，可通过 npm approve-scripts --allow-scripts-pending 查看待批准包，再用 approve-scripts 批准信任包并 deny-scripts 阻挡其余，生成的 allowlist 写入 package.json 并提交。升级后仅批准的脚本将继续运行。

荐读理由

npm v12 改 allowScripts 默认 off，需显式 npm approve-scripts 挂起 + approve 信任包后 commit 到 package.json，v12 后非批准脚本一律停止

原文

Back to changelog

Retired

June 9, 2026 • 2 minute read

Upcoming breaking changes for npm v12

Our next npm major version, v12, introduces security-related default changes to npm install. All these changes are available behind warnings in npm today on 11.16.0 or newer, so you can prepare before the upgrade. v12 is estimated to release in July 2026.

Each change turns an npm install behavior that runs automatically today into one you explicitly opt into:

  • allowScripts defaults to off: npm install will no longer execute preinstall, install, or postinstall scripts from dependencies unless they are explicitly allowed in your project. This includes native node-gyp builds (i.e., a package with a binding.gyp and no explicit install script still gets blocked, because npm runs an implicit node-gyp rebuild for it). prepare scripts from git, file, and link dependencies are blocked the same way. To see what would be blocked, run npm approve-scripts --allow-scripts-pending. Then allow the packages you trust with npm approve-scripts and block the rest with npm deny-scripts. The resulting allowlist is written to package.json and should be committed. If your install routine runs scripts, you can observe warnings in npm 11.16.0+.

  • --allow-git defaults to none: npm install will no longer resolve Git dependencies (direct or transitive) unless explicitly allowed via --allow-git. This closes a code-execution path where a Git dependency’s .npmrc could override the Git executable, even with --ignore-scripts. This change was previously announced on 2026-02-18 and is available in npm 11.10.0+.

  • --allow-remote defaults to none: npm install will no longer resolve dependencies from remote URLs, such as https tarballs (direct or transitive), unless explicitly allowed via --allow-remote. This flag is available in npm 11.15.0+. The related --allow-file and --allow-directory flags are not changing their defaults in v12.

How to prepare

Upgrade to npm 11.16.0 or later, run your normal install, and review the warnings. Use npm approve-scripts --allow-scripts-pending to see which packages have scripts, approve the ones you trust, and commit the updated package.json. After that, only the scripts you approved keep running once you upgrade. Anything you leave unapproved will stop. More details are available in our docs at npm approve-scripts, npm deny-scripts, and allow-scripts config (for npx and global installs). Please share your comments and questions in our community discussion.

Hacker News · 154 赞 · 48 评 讨论 → 阅读原文 →

这条对你有帮助吗？