Skip to content

[BUG] allowsScripts not respected by prune command #9435

@colincasey

Description

@colincasey

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

When you run npm prune it will display warn allow-scripts messages for packages configured in allowScripts as approved scripts.

Expected Behavior

No warn allow-scripts messages should appear during npm prune if the package is configured in allowScripts as an approved script.

Steps To Reproduce

  1. Create a folder and add the following package.json:
{
  "devDependencies": { "dtrace-provider": "0.8.8" },
  "allowScripts": { "dtrace-provider": true }
}
  1. Run npm prune
  2. The following output is displayed:
up to date, audited 3 packages in 652ms

found 0 vulnerabilities
npm warn allow-scripts 1 package has install scripts not yet covered by allowScripts:
npm warn allow-scripts   dtrace-provider@0.8.8 (install: node-gyp rebuild)
npm warn allow-scripts
npm warn allow-scripts Run `npm approve-scripts --allow-scripts-pending` to review, or `npm approve-scripts <pkg>` to allow.

Environment

  • npm: 11.16.0
  • Node.js: v26.2.0
  • OS Name: macOS 26.5
  • System Model Name: iMac
  • npm config:

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingNeeds Triageneeds review for next steps

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions