From 9c399c29bdc3da22c53e27eaa05ba78dbb869431 Mon Sep 17 00:00:00 2001
From: Sacha Al Himdani <sacha@probo.com>
Date: Wed, 24 Jun 2026 23:14:33 +0200
Subject: [PATCH] Add npm allowScripts policy for dependency install scripts

Allow install scripts for the packages we actually need (esbuild for
Vite builds, fsevents for dev file watching, unrs-resolver for n8n
linting) and deny the rest (core-js, isolated-vm,
eslint-plugin-n8n-nodes-base) so npm 11's install-script warning is
covered.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>
---
 package.json | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/package.json b/package.json
index ab8325aeb..e61a95707 100644
--- a/package.json
+++ b/package.json
@@ -33,6 +33,14 @@
     "form-data": "^4.0.6",
     "js-yaml": "^4.2.0"
   },
+  "allowScripts": {
+    "esbuild": true,
+    "fsevents": true,
+    "unrs-resolver": true,
+    "core-js": false,
+    "isolated-vm": false,
+    "eslint-plugin-n8n-nodes-base": false
+  },
   "license": "MIT",
   "packageManager": "npm@11.8.0",
   "dependencies": {