👋 folks!
I have started seeing this warning in pnpm install recently:
╭ Warning ───────────────────────────────────────────────────────────────────────────────────╮
│ │
│ Ignored build scripts: oxc-resolver. │
│ Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts. │
│ │
╰────────────────────────────────────────────────────────────────────────────────────────────╯
The warning is related to a recent update in a sub-dependency.
I went checking oxc-resolver to see if a post-install script was needed and found this: "postinstall": "napi-postinstall oxc-resolver 11.6.0 check". Exploring napi-postinstall on NPM and GitHub suggested that I could add oxs-resolver to pnpm-workspace.yaml → ignoredBuiltDependencies but it was not a very quick and clear decision to make.
It’d be great to see a TLDR section for folks like me, somewhere in the napi-postinstall README. If someone finds napi-postinstall mentioned in a postinstall script of a dependency, is it safe to turn it off or not? Who is the script for exactly? I believe that a small and an easy to digest section could save a lot of time, given the popularity of your package. Because napi-postinstall is targeting library developers, you can also create a README section for them with text to copy-paste into their READMEs.
Example: sharp - https://sharp.pixelplumbing.com/install/
When using pnpm, you may need to add sharp to ignoredBuiltDependencies to silence warnings.
Similar issue / docs request: esbuild - evanw/esbuild#4085 (comment)
CC @Boshen and @JounQin who have recent commits in oxc-resolver.
👋 folks!
I have started seeing this warning in
pnpm installrecently:The warning is related to a recent update in a sub-dependency.
I went checking
oxc-resolverto see if a post-install script was needed and found this:"postinstall": "napi-postinstall oxc-resolver 11.6.0 check". Exploringnapi-postinstallon NPM and GitHub suggested that I could addoxs-resolvertopnpm-workspace.yaml→ignoredBuiltDependenciesbut it was not a very quick and clear decision to make.It’d be great to see a TLDR section for folks like me, somewhere in the
napi-postinstallREADME. If someone findsnapi-postinstallmentioned in apostinstallscript of a dependency, is it safe to turn it off or not? Who is the script for exactly? I believe that a small and an easy to digest section could save a lot of time, given the popularity of your package. Becausenapi-postinstallis targeting library developers, you can also create a README section for them with text to copy-paste into their READMEs.Example:
sharp- https://sharp.pixelplumbing.com/install/Similar issue / docs request:
esbuild- evanw/esbuild#4085 (comment)CC @Boshen and @JounQin who have recent commits in
oxc-resolver.