feat: add default untrusted list by zkochan · Pull Request #4 · pnpm/plugin-trusted-deps

zkochan · 2026-03-23T10:09:20Z

Summary

Adds untrusted.js with a default list of packages whose postinstall scripts only print messages and are not needed for the package to function (core-js, core-js-pure, es5-ext, less, protobufjs)
Integrates the untrusted list into pnpmfile.cjs so these packages are excluded from onlyBuiltDependencies by default

…stall scripts

Copilot

Pull request overview

This PR introduces a default “untrusted” package list and integrates it into the pnpmfile.cjs hook so that certain packages’ lifecycle builds are disabled by default (or excluded from build-allow lists), while also adding a generated allowBuilds.json export for pnpm v11+ style configuration.

Changes:

Add untrusted.js with a default list of packages to disable builds for by default.
Update pnpmfile.cjs to apply the untrusted list to allowBuilds (pnpm >= 11) and ignoredBuiltDependencies (pnpm < 11).
Extend updateList.ts to generate allowBuilds.json, and export it from index.js.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`updateList.ts`	Generates `allowBuilds.json` in addition to `allow.json`.
`untrusted.js`	Defines the default untrusted package list.
`pnpmfile.cjs`	Applies defaults for untrusted packages across pnpm major versions.
`test.js`	Adds tests for untrusted-package behavior across pnpm versions.
`package.json`	Publishes new artifacts and adds `pretest` regeneration step.
`index.js`	Exports `DEFAULT_ALLOW_BUILDS` from `allowBuilds.json`.
`.gitignore`	Ignores generated `allowBuilds.json`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-23T10:28:22Z

updateList.ts


+  // Generate allowBuilds.json (Record<string, boolean>)
+  const { createRequire } = await import('node:module')
+  const require = createRequire(import.meta.url)


createRequire(import.meta.url) will throw if updateList.ts is executed as CommonJS (ts-node default when package.json has no type: "module"). Either run the script in ESM mode (e.g., ts-node --esm) or avoid import.meta.url here (e.g., use require directly / createRequire(__filename) in CJS).

Suggested change

const require = createRequire(import.meta.url)

const require = createRequire(__filename)

Copilot · 2026-03-23T10:28:22Z

updateList.ts

+    allowBuilds[pkg] = false
+  }
+  for (const pkg of combined) {
+    allowBuilds[pkg] = true


The allowBuilds generation currently sets untrusted packages to false and then unconditionally overwrites them to true if they also appear in combined. This makes the generated allowBuilds.json inconsistent with pnpmfile.cjs, where untrusted packages remain false. Consider only setting true when a package isn't already present (or explicitly prioritize false for untrusted).

Suggested change

allowBuilds[pkg] = true

if (!(pkg in allowBuilds)) {

allowBuilds[pkg] = true

}

Copilot · 2026-03-23T10:28:23Z

pnpmfile.cjs

+        config.ignoredBuiltDependencies.push(...defaultUntrusted)
+        const ignored = new Set(config.ignoredBuiltDependencies)
+        for (const allowed of defaultAllowed) {
+          if (!ignored.has(allowed)) {
+            config.onlyBuiltDependencies.push(allowed)
          }
        }


For pnpm < 11, config.ignoredBuiltDependencies.push(...defaultUntrusted) is not idempotent (running updateConfig multiple times will accumulate duplicates) and it also prevents users from overriding an untrusted package via config because the hook always re-adds it. Consider deduping before pushing and skipping packages that the user explicitly opted into via onlyBuiltDependencies.

Suggested change

config.ignoredBuiltDependencies.push(...defaultUntrusted)

const ignored = new Set(config.ignoredBuiltDependencies)

for (const allowed of defaultAllowed) {

if (!ignored.has(allowed)) {

config.onlyBuiltDependencies.push(allowed)

}

}

// Capture user choices before adding defaults

const userOnly = new Set(config.onlyBuiltDependencies)

const userIgnored = new Set(config.ignoredBuiltDependencies)

// Build ignored set: start from user ignored, then add default untrusted

// except for packages the user explicitly opted into via onlyBuiltDependencies

const ignored = new Set(userIgnored)

for (const untrusted of defaultUntrusted) {

if (!userOnly.has(untrusted)) {

ignored.add(untrusted)

}

}

config.ignoredBuiltDependencies = Array.from(ignored)

// Build onlyBuiltDependencies: start from user only, then add default allowed

// that are not in the final ignored set, deduping via Set

const only = new Set(userOnly)

for (const allowed of defaultAllowed) {

if (!ignored.has(allowed)) {

only.add(allowed)

}

}

config.onlyBuiltDependencies = Array.from(only)

Copilot · 2026-03-23T10:28:23Z

package.json

  ],
  "scripts": {
    "lint": "eslint .",
+    "pretest": "pnpm update-list",


Running pnpm update-list in pretest makes tests depend on the network (fetching from GitHub) and rewrites generated artifacts on every test run. This can make CI flaky/offline-unfriendly and can cause unrelated diffs when upstream lists change. Consider removing pretest and checking in allowBuilds.json (or using a deterministic fixture) so tests don't require regeneration.

Suggested change

"pretest": "pnpm update-list",

Copilot · 2026-03-23T10:28:23Z

index.js

 module.exports.TRUSTED_PACKAGE_NAMES = require('./allow.json')
+
+Object.defineProperty(module.exports, 'DEFAULT_ALLOW_BUILDS', {
+  get () { return require('./allowBuilds.json') },


index.js now unconditionally requires ./allowBuilds.json, but this file is gitignored and is only generated by update-list. Importing this package from a fresh checkout (or any environment that hasn't run pnpm update-list) will throw at require-time. Consider committing allowBuilds.json, generating it in a prepare/postinstall step, or making the export tolerant to the file being absent.

Suggested change

get () { return require('./allowBuilds.json') },

get () {

try {

return require('./allowBuilds.json')

} catch (e) {

if (e && (e.code === 'MODULE_NOT_FOUND' || e.code === 'ERR_MODULE_NOT_FOUND')) {

// If allowBuilds.json is not present (e.g. fresh checkout), fall back to an empty list.

return []

}

throw e

}

},

Copilot · 2026-03-23T10:28:24Z

test.js

+test('excludes untrusted packages for pnpm < 11', () => {
+  const config = {
+    packageManager: { version: '10.28.1' },
+  }
+  pnpmfile.hooks.updateConfig(config)
+  assert(!config.onlyBuiltDependencies.includes('core-js'))
+  assert(config.ignoredBuiltDependencies.includes('core-js'))
+})


The new untrusted behavior for pnpm < 11 isn't currently tested for idempotency or user override semantics. Consider adding a test that calls updateConfig twice and asserts ignoredBuiltDependencies doesn't accumulate duplicates, and (if intended) a test that a user can still explicitly allow a default-untrusted package.

… network-dependent pretest

feat: add default untrusted list for packages with unnecessary postin…

7c344dd

…stall scripts

zkochan force-pushed the untrusted branch from 7a88d21 to 7c344dd Compare March 23, 2026 10:12

feat: generate allowBuilds.json as Record<string, boolean> for pnpm v11

a796b60

zkochan marked this pull request as ready for review March 23, 2026 10:23

fix: run update-list before tests to generate allowBuilds.json

ab954a5

zkochan requested a review from Copilot March 23, 2026 10:24

Copilot started reviewing on behalf of zkochan March 23, 2026 10:25 View session

fix: lazy-load allowBuilds.json so tests work without generating it

e4ca3b7

Copilot AI reviewed Mar 23, 2026

View reviewed changes

fix: don't overwrite untrusted entries in allowBuilds.json and remove…

ba0ea6f

… network-dependent pretest

zkochan merged commit 100be8a into main Mar 23, 2026
1 check passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add default untrusted list#4

feat: add default untrusted list#4
zkochan merged 5 commits intomainfrom
untrusted

zkochan commented Mar 23, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	const require = createRequire(import.meta.url)
	const require = createRequire(__filename)

-        config.ignoredBuiltDependencies.push(...defaultUntrusted)
-        const ignored = new Set(config.ignoredBuiltDependencies)
-        for (const allowed of defaultAllowed) {
-          if (!ignored.has(allowed)) {
-            config.onlyBuiltDependencies.push(allowed)
-          }
-        }
+        // Capture user choices before adding defaults
+        const userOnly = new Set(config.onlyBuiltDependencies)
+        const userIgnored = new Set(config.ignoredBuiltDependencies)
+        // Build ignored set: start from user ignored, then add default untrusted
+        // except for packages the user explicitly opted into via onlyBuiltDependencies
+        const ignored = new Set(userIgnored)
+        for (const untrusted of defaultUntrusted) {
+          if (!userOnly.has(untrusted)) {
+            ignored.add(untrusted)
+          }
+        }
+        config.ignoredBuiltDependencies = Array.from(ignored)
+        // Build onlyBuiltDependencies: start from user only, then add default allowed
+        // that are not in the final ignored set, deduping via Set
+        const only = new Set(userOnly)
+        for (const allowed of defaultAllowed) {
+          if (!ignored.has(allowed)) {
+            only.add(allowed)
+          }
+        }
+        config.onlyBuiltDependencies = Array.from(only)

-  get () { return require('./allowBuilds.json') },
+  get () {
+    try {
+      return require('./allowBuilds.json')
+    } catch (e) {
+      if (e && (e.code === 'MODULE_NOT_FOUND' || e.code === 'ERR_MODULE_NOT_FOUND')) {
+        // If allowBuilds.json is not present (e.g. fresh checkout), fall back to an empty list.
+        return []
+      }
+      throw e
+    }
+  },

Conversation

zkochan commented Mar 23, 2026

Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants