diff --git a/docs/lib/content/commands/npm-approve-scripts.md b/docs/lib/content/commands/npm-approve-scripts.md index cd2b371b54f35..11a71f23bdc61 100644 --- a/docs/lib/content/commands/npm-approve-scripts.md +++ b/docs/lib/content/commands/npm-approve-scripts.md @@ -20,10 +20,10 @@ silently skip lifecycle scripts for any dependency that does not have a matching entry in `allowScripts`, and end with a list of the packages whose scripts were skipped so you can review them with this command. -This command only works inside a project that has a `package.json`. It does -not apply to global installs (`npm install -g`) or one-off executions -(`npm exec` / `npx`), which have no project `package.json` to write to and -will fail with an `EGLOBAL` error. To allow install scripts in those +This command only works inside a project that has a `package.json`. Running +it with `--global` (`-g`) fails with an `EGLOBAL` error, since global +installs (`npm install -g`) and one-off executions (`npm exec` / `npx`) have +no project `package.json` to write to. To allow install scripts in those contexts, use the `--allow-scripts` flag at install time (for example `npm install -g --allow-scripts=canvas,sharp`) or persist the setting with `npm config set allow-scripts=canvas,sharp --location=user`. diff --git a/workspaces/config/lib/definitions/definitions.js b/workspaces/config/lib/definitions/definitions.js index 25f7682073317..b8ac97779c339 100644 --- a/workspaces/config/lib/definitions/definitions.js +++ b/workspaces/config/lib/definitions/definitions.js @@ -2329,16 +2329,16 @@ const definitions = { default: false, type: Boolean, description: ` - If \`true\`, turn the install-script policy from a silent skip into a - hard error: any dependency with install scripts not covered by - \`allowScripts\` will fail the install instead of being silently - skipped. - - By default, dependencies whose install scripts are not approved in - \`allowScripts\` are silently skipped; this setting promotes that - silent skip into a hard failure, which is the recommended posture - for CI. \`--ignore-scripts\` and \`--dangerously-allow-all-scripts\` - both override this setting. + If \`true\`, turn the install-script policy from a warning into a hard + error: any dependency with install scripts that is not covered by + \`allowScripts\` will fail the install instead of being blocked with a + warning. + + Dependencies explicitly denied with \`false\` in \`allowScripts\` are + always silently skipped; this setting only affects unreviewed entries + (packages with install scripts that are neither approved nor denied). + \`--ignore-scripts\` and \`--dangerously-allow-all-scripts\` both + override this setting. `, flatten, }),