feat: add allowBuildsOfTrustedDeps setting (true by default) by zkochan · Pull Request #11078 · pnpm/pnpm

zkochan · 2026-03-24T08:01:57Z

Summary

Adds a new allowBuildsOfTrustedDeps setting (default: true) that automatically loads a curated list of ~370 known-good packages from @pnpm/plugin-trusted-deps into allowBuilds
User-configured allowBuilds entries take precedence over the defaults
The default list is bundled into the pnpm CLI via a static import that esbuild inlines
The default list is never persisted to pnpm-workspace.yaml — only user-configured entries are written back
Set allowBuildsOfTrustedDeps: false to opt out

Test plan

Compilation succeeds
Existing config reader tests pass (72/72)
Verified esbuild bundles the JSON data inline
approveBuilds tests pass with default list disabled
E2E: install a project with a dependency that has build scripts and is in the default list — should build without manual allowBuilds config
E2E: install with allowBuildsOfTrustedDeps: false — should behave as before

Add a new `use-default-trusted-deps` setting (default: true) that automatically loads a curated list of known-good packages into `allowBuilds` from @pnpm/plugin-trusted-deps. User-configured allowBuilds entries take precedence over the defaults. Set `use-default-trusted-deps=false` to disable.

The package uses Object.defineProperty for DEFAULT_ALLOW_BUILDS, which Node.js/Jest ESM interop can't detect as a named export. Switch to a default import to fix test failures.

The package now ships an ESM entry point with proper named exports, so we can use a clean named import instead of the default import workaround.

Uses static JSON import attributes in ESM entry, fixing the bundle issue where createRequire resolved paths relative to the bundle output instead of the original package.

The tests assert exact allowBuilds contents, so the default trusted list must be disabled to avoid polluting the expected values.

Track the user's original allowBuilds separately as userAllowBuilds before merging the default trusted list. Use userAllowBuilds when writing back to pnpm-workspace.yaml to avoid persisting the ~370 default entries from @pnpm/plugin-trusted-deps.

Copilot

Pull request overview

Adds a new config setting that enables a bundled “trusted deps” allowlist to automatically populate allowBuilds by default, while ensuring only user-provided allowBuilds entries are written back to workspace config.

Changes:

Introduces allowBuildsOfTrustedDeps (default true) and wires it into config parsing/defaults.
Merges @pnpm/plugin-trusted-deps’s DEFAULT_ALLOW_BUILDS into allowBuilds while preserving the pre-merge userAllowBuilds for write-back.
Updates approve-builds and ignored-build handling to avoid persisting the default trusted list into pnpm-workspace.yaml.

Reviewed changes

Copilot reviewed 13 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pnpm/artifacts/exe/pn	Adds blank placeholder executable artifact file.
pnpm/artifacts/exe/pnx	Adds blank placeholder executable artifact file.
pnpm/artifacts/exe/pnpx	Adds blank placeholder executable artifact file.
pnpm-workspace.yaml	Adds `@pnpm/plugin-trusted-deps` to the workspace catalog.
pnpm-lock.yaml	Locks `@pnpm/plugin-trusted-deps@0.3.0-2`.
installing/commands/src/handleIgnoredBuilds.ts	Writes back `allowBuilds` using `userAllowBuilds` to avoid persisting defaults.
config/reader/src/types.ts	Registers `allow-builds-of-trusted-deps` config schema type.
config/reader/src/index.ts	Defaults `allow-builds-of-trusted-deps` to `true` and merges trusted defaults into `allowBuilds`.
config/reader/src/configFileKey.ts	Allows `allow-builds-of-trusted-deps` in global config files.
config/reader/src/Config.ts	Adds `allowBuildsOfTrustedDeps` and `userAllowBuilds` to the `Config` type.
config/reader/package.json	Adds dependency on `@pnpm/plugin-trusted-deps`.
building/commands/test/policy/approveBuilds.test.ts	Disables trusted defaults in tests to preserve prior expectations.
building/commands/src/policy/approveBuilds.ts	Uses `userAllowBuilds` as the base for persisted allowBuilds updates.
typings/local.d.ts	Adds local typings for `@pnpm/plugin-trusted-deps`.
.changeset/use-default-trusted-deps.md	Changeset documenting the new setting and default behavior.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-24T18:13:26Z

+  if (pnpmConfig.allowBuildsOfTrustedDeps) {
+    // Save the user-configured allowBuilds before merging defaults.
+    // This is used when writing back to pnpm-workspace.yaml to avoid
+    // persisting the default trusted list.
+    pnpmConfig.userAllowBuilds = pnpmConfig.allowBuilds
+    // User-configured allowBuilds take precedence over the defaults.
+    pnpmConfig.allowBuilds = { ...DEFAULT_ALLOW_BUILDS, ...pnpmConfig.allowBuilds }
+  }


The new allowBuildsOfTrustedDeps behavior (capturing userAllowBuilds and merging DEFAULT_ALLOW_BUILDS into allowBuilds) isn’t covered by config reader tests. Please add coverage that asserts: (1) default is enabled and allowBuilds includes trusted defaults, (2) user allowBuilds overrides defaults, (3) setting allow-builds-of-trusted-deps=false disables the merge, and (4) userAllowBuilds preserves the pre-merge values used for write-back.

Without this, userAllowBuilds wasn't passed through to handleIgnoredBuilds, causing the default trusted list to be written to pnpm-workspace.yaml during e2e tests.

When the user has no allowBuilds configured, userAllowBuilds was undefined, causing handleIgnoredBuilds to fall back to the merged allowBuilds (with defaults). Use empty object instead so the fallback doesn't trigger.

Instead of tracking userAllowBuilds separately (which gets stale when other code writes to pnpm-workspace.yaml mid-install), read the current allowBuilds directly from pnpm-workspace.yaml before writing. This avoids persisting the default trusted list and preserves entries written by --allow-build earlier in the flow. Also update e2e test expectation: esbuild is now in the default trusted list, so it builds instead of being ignored.

The execPnpmInstall helper runs the bundled CLI which picks up the default allowBuildsOfTrustedDeps=true. This causes extra placeholder entries in pnpm-workspace.yaml that break assertions.

approveBuilds.handler should use opts.allowBuilds from getConfig() (which excludes trusted deps defaults when disabled) rather than reading the workspace manifest. The handler's job is to write approve/deny decisions, not merge with auto-populated placeholders.

Cover: (1) default enabled with trusted defaults merged, (2) user allowBuilds overrides defaults, (3) setting allow-builds-of-trusted-deps=false disables the merge.

dasa · 2026-03-26T00:31:58Z

This is probably a convenience vs. security tradeoff, but this seems to put quite a lot of trust in the vetting of the list of trusted packages, and that they won't become malicious in the future. Maybe this should be an opt-in feature?

zkochan · 2026-03-26T01:24:49Z

62% of the pnpm users want this to be the default: https://x.com/pnpmjs/status/1960322324999098403

zkochan · 2026-03-26T14:11:52Z

Created a new poll: https://x.com/pnpmjs/status/2037119638748696924

…#11078)" This reverts commit 5a3dc4a.

zkochan · 2026-03-26T19:18:00Z

The changes has been reverted 0e8042e

zkochan added 3 commits March 24, 2026 08:59

fix: use catalog reference for @pnpm/plugin-trusted-deps

6e11c94

fix: use default import for @pnpm/plugin-trusted-deps CJS compat

ac05cfd

The package uses Object.defineProperty for DEFAULT_ALLOW_BUILDS, which Node.js/Jest ESM interop can't detect as a named export. Switch to a default import to fix test failures.

zkochan added this to the v11.0 milestone Mar 24, 2026

zkochan added 6 commits March 24, 2026 17:46

fix: use named ESM import from @pnpm/plugin-trusted-deps@0.3.0-1

507b9a5

The package now ships an ESM entry point with proper named exports, so we can use a clean named import instead of the default import workaround.

fix: update @pnpm/plugin-trusted-deps to 0.3.0-2

5fe5ec8

Uses static JSON import attributes in ESM entry, fixing the bundle issue where createRequire resolved paths relative to the bundle output instead of the original package.

refactor: rename setting to allow-builds-for-trusted-deps

3b7b775

test: disable default trusted deps in approveBuilds tests

7e51953

The tests assert exact allowBuilds contents, so the default trusted list must be disabled to avoid polluting the expected values.

refactor: rename setting to allow-builds-of-trusted-deps

8652760

zkochan changed the title ~~feat: load default trusted deps list from @pnpm/plugin-trusted-deps~~ feat: add allow-builds-of-trusted-deps setting Mar 24, 2026

zkochan changed the title ~~feat: add allow-builds-of-trusted-deps setting~~ feat: add allowBuildsOfTrustedDeps setting Mar 24, 2026

docs: use camelCase for setting name in changeset

b881ec9

zkochan changed the title ~~feat: add allowBuildsOfTrustedDeps setting~~ feat: add allowBuildsOfTrustedDeps setting (true by default) Mar 24, 2026

zkochan marked this pull request as ready for review March 24, 2026 18:07

Copilot AI review requested due to automatic review settings March 24, 2026 18:07

Copilot started reviewing on behalf of zkochan March 24, 2026 18:07 View session

Copilot AI reviewed Mar 24, 2026

View reviewed changes

zkochan added 7 commits March 24, 2026 19:50

fix: include userAllowBuilds in install command opts types

39151b1

Without this, userAllowBuilds wasn't passed through to handleIgnoredBuilds, causing the default trusted list to be written to pnpm-workspace.yaml during e2e tests.

fix: set userAllowBuilds to empty object when user has no config

0c0b8d4

When the user has no allowBuilds configured, userAllowBuilds was undefined, causing handleIgnoredBuilds to fall back to the merged allowBuilds (with defaults). Use empty object instead so the fallback doesn't trigger.

chore: update tsconfig references for new dependencies

7be3f8a

test: disable default trusted deps in approveBuilds e2e install

ba26054

The execPnpmInstall helper runs the bundled CLI which picks up the default allowBuildsOfTrustedDeps=true. This causes extra placeholder entries in pnpm-workspace.yaml that break assertions.

test: add config reader tests for allowBuildsOfTrustedDeps

5269307

Cover: (1) default enabled with trusted defaults merged, (2) user allowBuilds overrides defaults, (3) setting allow-builds-of-trusted-deps=false disables the merge.

zkochan merged commit 5a3dc4a into main Mar 25, 2026
12 checks passed

zkochan deleted the default-trusted-deps branch March 25, 2026 15:42

zkochan added a commit that referenced this pull request Mar 26, 2026

revert: "feat: add allowBuildsOfTrustedDeps setting (true by default) (…

0e8042e

…#11078)" This reverts commit 5a3dc4a.

btea mentioned this pull request Mar 27, 2026

Add allowBuildsOfTrustedDeps to pnpm-workspace.json SchemaStore/schemastore#5505

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add allowBuildsOfTrustedDeps setting (true by default)#11078

feat: add allowBuildsOfTrustedDeps setting (true by default)#11078
zkochan merged 17 commits into
mainfrom
default-trusted-deps

zkochan commented Mar 24, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 24, 2026

Uh oh!

Uh oh!

dasa commented Mar 26, 2026

Uh oh!

zkochan commented Mar 26, 2026 •

edited

Loading

Uh oh!

zkochan commented Mar 26, 2026

Uh oh!

zkochan commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

zkochan commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

dasa commented Mar 26, 2026

Uh oh!

zkochan commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zkochan commented Mar 26, 2026

Uh oh!

zkochan commented Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zkochan commented Mar 24, 2026 •

edited

Loading

zkochan commented Mar 26, 2026 •

edited

Loading