create-next-app: pnpm v10 blocks sharp build #83158
Description
Link to the code that reproduces this issue
https://github.com/karlhorky/repro-create-next-app-pnpm-ignored-build-scripts
To Reproduce
- Use pnpm v10+
- Use
create-next-appto create an app (flags are irrelevant, occurs with any flags), eg:$ pnpm create next-app@15.5.1-canary.14 . --app --no-src-dir --no-eslint --import-alias @/\* --no-tailwind --typescript --turbopack
- Observe a pnpm warning (see below) that the
sharpbuild script has not been run, with a message to runpnpm approve-builds - Optional: configure
strict-dep-builds=truein~/.npmrcand the warning becomes an error, with a non-zero exit code
Warning:
$ pnpm create next-app@15.5.1-canary.14 . --app --no-src-dir --no-eslint --import-alias @/\* --no-tailwind --typescript --turbopack
Creating a new Next.js app in /Users/k/p/b.
Using pnpm.
Initializing project with template: app
Installing dependencies:
- react
- react-dom
- next
Installing devDependencies:
- typescript
- @types/node
- @types/react
- @types/react-dom
Packages: +32
++++++++++++++++++++++++++++++++
Progress: resolved 60, reused 33, downloaded 0, added 32, done
dependencies:
+ next 15.5.1-canary.14 (15.5.2 is available)
+ react 19.1.0 (19.1.1 is available)
+ react-dom 19.1.0 (19.1.1 is available)
devDependencies:
+ @types/node 20.19.11 (24.3.0 is available)
+ @types/react 19.1.12
+ @types/react-dom 19.1.8
+ typescript 5.9.2
╭ Warning ───────────────────────────────────────────────────────────────────────────────────╮
│ │
│ Ignored build scripts: sharp. │
│ Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts. │
│ │
╰────────────────────────────────────────────────────────────────────────────────────────────╯
Done in 1.8s using pnpm v10.15.0
Initialized a git repository.
Success! Created b at /Users/k/p/bError with strict-dep-builds=true in ~/.npmrc:
$ pnpm create next-app@15.5.1-canary.14 . --app --no-src-dir --no-eslint --import-alias @/\* --no-tailwind --typescript --turbopack
Creating a new Next.js app in /Users/k/p/a.
Using pnpm.
Initializing project with template: app
Installing dependencies:
- react
- react-dom
- next
Installing devDependencies:
- typescript
- @types/node
- @types/react
- @types/react-dom
Packages: +32
++++++++++++++++++++++++++++++++
Downloading next@15.5.1-canary.14: 30.35 MB/30.35 MB, done
Downloading @next/swc-darwin-arm64@15.5.1-canary.14: 42.72 MB/42.72 MB, done
Progress: resolved 60, reused 27, downloaded 6, added 32, done
dependencies:
+ next 15.5.1-canary.14 (15.5.2 is available)
+ react 19.1.0 (19.1.1 is available)
+ react-dom 19.1.0 (19.1.1 is available)
devDependencies:
+ @types/node 20.19.11 (24.3.0 is available)
+ @types/react 19.1.12
+ @types/react-dom 19.1.8
+ typescript 5.9.2
ERR_PNPM_IGNORED_BUILDS Ignored build scripts: sharp
Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.
Aborting installation.
pnpm install has failed.Current vs. Expected behavior
Current: pnpm warning or error on create-next-app
Expected: no pnpm warning or error on create-next-app
Suggested Solution
Configure pnpm.onlyBuiltDependencies with 'sharp' in the generated package.json as mentioned in the pnpm v10 release notes:
package.json
{
"pnpm": {
"onlyBuiltDependencies": ["sharp"]
}
}Alternatively, onlyBuiltDependencies can also be set in a pnpm-workspace.yaml file. But currently pnpm-workspace.yaml is not generated by create-next-app.
onlyBuiltDependencies:
- sharpProvide environment information
Operating System:
Platform: darwin
Arch: arm64
Version: Darwin Kernel Version 24.6.0: Mon Jul 14 11:30:34 PDT 2025; root:xnu-11417.140.69~1/RELEASE_ARM64_T8103
Available memory (MB): 16384
Available CPU cores: 8
Binaries:
Node: 22.18.0
npm: 10.9.3
Yarn: 1.22.22
pnpm: 10.15.0
Relevant Packages:
next: 15.5.1-canary.14 // Latest available version is detected (15.5.1-canary.14).
eslint-config-next: N/A
react: 19.1.0
react-dom: 19.1.0
typescript: 5.9.2
Next.js Config:
output: N/AWhich area(s) are affected? (Select all that apply)
create-next-app
Which stage(s) are affected? (Select all that apply)
next start (local), next build (local), next dev (local)
Additional context
--