Skip to content

fix: respect gypfile:false when detecting install scripts - #10061

Open
JamieMagee wants to merge 2 commits into
npm:latestfrom
JamieMagee:fix/gypfile-false-lockfiles
Open

JamieMagee wants to merge 2 commits into
npm:latestfrom
JamieMagee:fix/gypfile-false-lockfiles

Conversation

@JamieMagee

Copy link
Copy Markdown
Contributor

Arborist reads the installed package before inferring node-gyp rebuild, so lockfile installs respect gypfile: false and avoid false blocked-script warnings. The fix covers linked installs and scripts: null, with regression tests for stale script flags. Explicit scripts and the lockfile format are unchanged.

References

Fixes #9837

@JamieMagee
JamieMagee requested a review from a team as a code owner October 2, 2026 05:25
@JamieMagee
JamieMagee force-pushed the fix/gypfile-false-lockfiles branch from fc8a3a2 to 9e4f5b9 Compare October 2, 2026 21:48
Comment thread workspaces/arborist/lib/install-scripts.js
Comment thread workspaces/arborist/lib/arborist/rebuild.js
Comment thread docs/lib/content/configuring-npm/package-json.md Outdated
Comment thread workspaces/arborist/lib/install-scripts.js Outdated
Comment thread docs/lib/content/configuring-npm/package-json.md Outdated
Comment thread workspaces/arborist/lib/install-scripts.js
@JamieMagee

JamieMagee commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor Author

Strict preflight now uses only incoming metadata and preserves known script bodies. Linked installs sync rebuilt metadata back to logical nodes, including stale hasInstallScript cleanup for transitive dependencies. Regressions cover rejection before mutation for same-version replacements, plus fresh, clean, and repeated transitive linked installs. I also restored the package-root wording.

@manzoorwanijk manzoorwanijk left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good to me now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Incorrect detection of install script for better-sqlite3@13.0.2?

4 participants