pnpm v10 now blocks dependency lifecycle scripts by default

Key update

pnpm v10 (stable) changes the default install behavior so that lifecycle scripts defined in dependencies no longer run during installation unless explicitly allowed (via pnpm.onlyBuiltDependencies, an allowlist file, or by approving builds). This is a deliberate, breaking change aimed at preventing supply‑chain attacks that execute malicious postinstall/preinstall scripts. (github.com)

Why it matters

This is a practical security pivot with immediate operational impact. Teams using pnpm may see CI and local installs fail for packages that rely on build/install scripts (native modules like bcrypt, Prisma engines, esbuild, sqlite3, etc.), because those scripts are now ignored until you approve them. The change reduces automatic attack surface from untrusted dependency scripts, but it requires a small migration: either pre-approve required packages with the new pnpm approve-builds command or add approved names to pnpm.onlyBuiltDependencies (or use a managed onlyBuiltDependenciesFile supplied by an internal policy package). In CI you should pin the pnpm version via the packageManager field, pre-seed the allowlist (or run a deterministic, non-interactive approval step), and test builds end-to-end before rolling the change across monorepos. For teams that cannot adopt the allowlist immediately, pnpm provides a way to restore pre-v10 behavior by configuring neverBuiltDependencies, but relying on that forfeits the security benefit. Overall, this is a small upfront operational cost that meaningfully hardens installs against common install‑script supply‑chain attacks. (github.com)

Source

• Source