Skip to content

fix: recognize allowScripts for local link targets - #9490

Merged
owlstronaut merged 2 commits into
npm:latestfrom
cyphercodes:fix/9488-allow-scripts-file-deps
Jun 5, 2026
Merged

fix: recognize allowScripts for local link targets#9490
owlstronaut merged 2 commits into
npm:latestfrom
cyphercodes:fix/9488-allow-scripts-file-deps

Conversation

@cyphercodes

@cyphercodes cyphercodes commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Recognize local directory link targets by their incoming link source when matching allowScripts policy entries.
  • Reuse that source identity when approve-scripts/deny-scripts derive file dependency policy keys.
  • Add coverage for reviewed local file: dependency link targets.

Fixes #9488

Testing

  • node node_modules/tap/bin/run.js --no-coverage workspaces/arborist/test/script-allowed.js workspaces/arborist/test/unreviewed-scripts.js test/lib/utils/allow-scripts-writer.js test/lib/utils/check-allow-scripts.js test/lib/utils/resolve-allow-scripts.js
  • node node_modules/eslint/bin/eslint.js lib/utils/allow-scripts-writer.js test/lib/utils/allow-scripts-writer.js workspaces/arborist/lib/script-allowed.js workspaces/arborist/test/script-allowed.js workspaces/arborist/test/unreviewed-scripts.js
  • git diff --check
  • Manual repro: local file: dependency with allowScripts: { "file:../testdep": false } no longer emits an allow-scripts warning; npm approve-scripts --all writes file:../testdep.