Current pnpm treats dependency build scripts as unreviewed and blocks them until you approve each package. The allowBuilds setting lists which packages may run scripts. With strictDepBuilds on, an install that finds unreviewed scripts exits with an error. Approve only packages you have checked, and avoid the allow-all switch.
What the docs say
The pnpm build settings page states that dependency build scripts do not run unless approved. Packages not listed in allowBuilds are disallowed by default and treated as unreviewed. The page does not name the release where blocking became default, so check your own version.
Version notes from the page: strictDepBuilds was added in v10.3.0, allowBuilds in v10.26.0, and in v11 the older settings onlyBuiltDependencies, onlyBuiltDependenciesFile, neverBuiltDependencies, ignoredBuiltDependencies and ignoreDepScripts were removed. Their entries map to true or false in allowBuilds. A codemod, run through pnpx as pnpm-v10-to-v11, migrates them.
How the settings work
allowBuilds is a map of package matchers to true (allow) or false (deny). During install, unreviewed packages are added to pnpm-workspace.yaml with placeholder values for you to set. A package name alone does not approve a git or tarball dependency. You approve it by exact resolved path or repository URL.
strictDepBuilds defaults to true, so install exits non-zero when dependencies have unreviewed scripts. Setting it to false prints a warning instead. ignoreScripts defaults to false, and setting it to true stops all scripts, though it does not stop the pnpmfile from running.
The setting to avoid
dangerouslyAllowAllBuilds runs every dependency build script without approval, including future ones. The pnpm page warns that this trusts the entire dependency graph, now and later, and recommends explicit review.
An approval routine
- Run install and read the list of blocked packages.
- For each, ask whether it genuinely needs a build step, such as compiling a native addon or downloading a binary.
- Check the package publisher and recent versions.
- Set it to true in allowBuilds, and commit the change so reviewers see it.
- Set denied packages to false so the decision is recorded.
- Treat a new entry in that map like a new dependency in code review.
| Setting | Effect |
|---|---|
| allowBuilds true | Package may run its build script |
| allowBuilds false | Package is denied |
| strictDepBuilds true | Install fails on unreviewed scripts |
| dangerouslyAllowAllBuilds true | All scripts run, including future ones |
Try it yourself
Click through it at your own pace, or open it full screen.
See how a pull request is held until a policy passes. An allowBuilds change deserves the same review step.
Quick check
What replaced onlyBuiltDependencies?
The allowBuilds map. In pnpm v11 the older settings were removed and their entries map to true or false in allowBuilds.
Is dangerouslyAllowAllBuilds a good shortcut?
No. It trusts the whole dependency graph, now and in the future. The docs recommend explicit review.
Safeguard policies and gates can review dependency changes in pull requests, and the free scan at gold.safeguard.sh/scan inventories your packages.
Sources
Last reviewed: 19 October 2026.
