/var/lang/lib/node_modules/npm/docs/content/commands
This explorer reads the filesystem of the server it runs on, so /workspace/user isn't present here. Browsing and the terminal still work against this server's own disk from /.
---title: npm-approve-scriptssection: 1description: Approve install scripts for specific dependencies--- ### Synopsis ```bashnpm approve-scripts <pkg> [<pkg> ...]npm approve-scripts --allnpm approve-scripts --allow-scripts-pending``` Note: This command is unaware of workspaces. ### Description Manages the `allowScripts` field in your project's `package.json`, whichrecords which of your dependencies are permitted to run install scripts(`preinstall`, `install`, `postinstall`, and `prepare` for non-registrysources). This command is the recommended way to maintain that field. In the current release, this field is advisory: install scripts still runby default, but installs print a list of packages whose scripts have notbeen reviewed. A future release will block unreviewed install scripts. This command only works inside a project that has a `package.json`. Runningit with `--global` (`-g`) fails with an `EGLOBAL` error, since globalinstalls (`npm install -g`) and one-off executions (`npm exec` / `npx`) haveno project `package.json` to write to. To allow install scripts in thosecontexts, use the `--allow-scripts` flag at install time (for example`npm install -g --allow-scripts=canvas,sharp`) or persist the setting with`npm config set allow-scripts=canvas,sharp --location=user`. There are three modes: ```bashnpm approve-scripts <pkg> [<pkg> ...]npm approve-scripts --allnpm approve-scripts --allow-scripts-pending``` `<pkg>` matches every installed version of that package. By default thecommand writes pinned entries (`pkg@1.2.3`), which keep their approvalnarrowed to the specific version you reviewed. Pass `--no-allow-scripts-pin` to writename-only entries that allow any future version. `--all` approves every package with unreviewed install scripts in one go. `--allow-scripts-pending` is read-only: it lists every package whose install scriptsare not yet covered by `allowScripts`, without modifying `package.json`. `approve-scripts` honours the asymmetric pin rule: if you re-approve apackage whose installed version has changed, the existing pin is rewrittento track the new installed version. Multi-version statements(`pkg@1 || 2`) are left alone, since they likely capture intent thatthe command cannot infer. Existing `false` entries always win;`approve-scripts` will not silently re-allow a package you previouslydenied. ### Examples ```bash# Approve all currently-installed install scripts after reviewing themnpm approve-scripts --all # Approve specific packages, pinned to their installed versionnpm approve-scripts canvas sharp # Approve name-only (any version of this package is allowed)npm approve-scripts --no-allow-scripts-pin canvas # Preview which packages still need reviewnpm approve-scripts --allow-scripts-pending``` ### Configuration #### `all` * Default: false* Type: Boolean Show or act on all packages, not just the ones your project directly dependson. For `npm outdated` and `npm ls` this lists every outdated or installedpackage. For `npm approve-scripts` and `npm deny-scripts` it selects everypackage with pending install scripts. #### `allow-scripts-pending` * Default: false* Type: Boolean List packages with install scripts that are not yet covered by the`allowScripts` policy, without modifying `package.json`. Only meaningful for`npm approve-scripts`. #### `allow-scripts-pin` * Default: true* Type: Boolean Write pinned (`pkg@version`) entries when approving install scripts. Set to`false` to write name-only entries that allow any version. Has no effect on`npm deny-scripts`, which always writes name-only entries regardless of thissetting. #### `json` * Default: false* Type: Boolean Whether or not to output JSON data, rather than the normal output. * In `npm pkg set` it enables parsing set values with JSON.parse() before saving them to your `package.json`. Not supported by all npm commands. ### See Also * [npm deny-scripts](/commands/npm-deny-scripts)* [npm install](/commands/npm-install)* [npm rebuild](/commands/npm-rebuild)* [package.json](/configuring-npm/package-json)