- Published on
Starting with pnpm v10, dependency install scripts are blocked by default, requiring explicit approval through pnpm approve-builds. This shift from 'allow all' to 'deny by default' significantly reduces supply chain attack vectors while maintaining developer control over legitimate build requirements.