Repository navigation
[BUG] Verbose and duplicate entries in allowScripts created when install-strategy=linked #9939
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
This is not just a request to bump a dependency for a CVE
- This is not solely a request to bump a dependency for a CVE
Current Behavior
When using install-strategy=linked and adding a package to allowScripts I get weird output:
{
"allowScripts": {
"file:../../../vue-demi@0.14.10-pGPQNZuy2Yfs8dw1nOAidw/node_modules/vue-demi": true,
"file:../../../esbuild@0.28.2-5fSWMmpOnxTxpz8DaF55tQ/node_modules/esbuild": true,
"file:../../esbuild@0.28.2-5fSWMmpOnxTxpz8DaF55tQ/node_modules/esbuild": true
}
}Expected Behavior
When not using a linked install strategy I get concise entries, without duplicates (see the difference for esbuild)
{
"allowScripts": {
"vue-demi@0.14.10": true,
"esbuild@0.28.2": true
}
}Steps To Reproduce
- Create a clean project
- Add
install-strategy = "linked"to the.npmrc - Install
esbuild - Run
npm install-scripts approve esbuild - Look at the state of
allowScriptsinpackage.json
Environment
- npm: 11.19.0
- Node.js: 26.7.0
- OS Name: macOS Sequoia 15.7.9
- System Model Name: Macbook Pro
- npm config:
; "user" config
; min-release-age = 14 ; overridden by project
; "project" config
install-strategy = "linked"
min-release-age = 14
; node bin location = /Users/name/.nvm/versions/node/v26.7.0/bin/node
; node version = v26.7.0
; npm local prefix = /Volumes/projects/project
; npm version = 11.19.0
; cwd = /Volumes/projects/project
; HOME = /Users/name
; Run `npm config ls -l` to show all defaults.
Activity
nikolawork commentedon Sep 1, 2026
cc @manzoorwanijk
manzoorwanijk commentedon Sep 1, 2026
Yes, I can reproduce it locally, and I am working on a fix. Thank you for reporting it.
manzoorwanijk commentedon Sep 1, 2026
#9941 should fix it. It would be great if you could help test it and verify the fix.
nikolawork commentedon Sep 1, 2026
I think you mean #9941?
Would love to help test. How can I install the version from your PR so I can test the fix?
manzoorwanijk commentedon Sep 1, 2026
Yeah, that’s right. Sorry for the confusion.
Once you checkout the PR, you can replace
npmin your commands withnode <path/to/cloned/cli>fix: write registry allowScripts keys under install-strategy=linked (#…