Before you act
- Confirm that the scope matches your case.
- Keep recommendations, enforced limits, exceptions, and unstated details distinct.
- Open the official source before relying on the rule for a consequential decision.
Source-backed platform rule
pnpm 10 approve-builds configuration
The 10.x page documents approve-builds as added in v10.1.0. It stores decisions in two arrays. A decision to run a dependency script is a security choice, not just an installation workaround.
RuleRoster is independent and is not affiliated with or endorsed by pnpm.
Direct answer
What is the rule?
In pnpm's 10.x documentation, approve-builds records approved dependencies in onlyBuiltDependencies and unapproved dependencies in ignoredBuiltDependencies in pnpm-workspace.yaml. This archived configuration is not the current allowBuilds map or the permissions-aware rule.
- Scope
- pnpm_10_x_archive
- Rule verified
- October 14, 2026
- Source checked
- October 19, 2026
Published evidence
Rule details
Where decisions are stored
The 10.x page documents approve-builds as added in v10.1.0. It stores decisions in two arrays. A decision to run a dependency script is a security choice, not just an installation workaround.
Version and configuration scope
Check the installed pnpm version and the version selector in the official documentation before applying this rule. An archive and the unversioned page describe different configurations; do not copy one into the other without checking support.
Approving a build is an explicit trust decision
Approval lets a dependency run scripts during installation. Review the package and the required build operation before approving it. This reference does not approve any dependencies or recommend blanket approval.
Evidence and renewal
The exact versioned_docs/version-10.x/cli/approve-builds.md document is pinned at 4a89ca5d576167ea6120f7030c895465ec186d8c. The extractor requires its exact bytes and scoped statement; source changes require a new reviewed revision.
Source attribution, license, and changes
pnpm documentation by Zoltan Kochan and other contributors. Copyright (c) 2016-2022 Zoltan Kochan and other contributors. MIT License: https://github.com/pnpm/pnpm.io/blob/4a89ca5d576167ea6120f7030c895465ec186d8c/LICENSE. RuleRoster extracted and paraphrased the scoped configuration. No endorsement is implied.
Interpretation and accountability
How to use this record
Record dates
- Published
- October 14, 2026
- Rule verified
- October 14, 2026
- Source checked
- October 19, 2026
- Review due
- November 2, 2026
Challenge this record
If the source or summary appears wrong, submit precise evidence for human review.