AUG 22, 2026

pnpm 10 blocks dependency postinstall scripts by default

Install warnings about 'ignored build scripts' are a security feature, not a bug — allowlist per package with onlyBuiltDependencies.

pnpmtil

Setting up this monorepo, pnpm install printed Ignored build scripts: unrs-resolver and everything still worked. Turns out pnpm 10 refuses to run dependencies' lifecycle scripts (postinstall etc.) unless you explicitly allow them — a supply-chain defense added after the 2024-25 npm worm wave.

The fix, when a package genuinely needs its script:

pnpm-workspace.yaml

onlyBuiltDependencies:
  - sharp

Most packages ship prebuilt binaries and never needed the script anyway — which is exactly why the default flipped.