setup_nodejs: bypass npm allowScripts policy globally on npm >=11

2026-08-05 04:13:24 +02:00 · 2026-08-04 23:13:12 +02:00
3 changed files with 11 additions and 5 deletions
@@ -46,11 +46,8 @@ function update_script() {

    msg_info "Updating Heimdall-Dashboard"
    cd /opt/Heimdall
-    sed -i 's/^APP_ENV=.*/APP_ENV=production/' .env
-    rm -f bootstrap/cache/*.php
    export COMPOSER_ALLOW_SUPERUSER=1
-    $STD composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader
-    $STD php artisan optimize:clear
+    $STD composer dump-autoload
    msg_ok "Updated Heimdall-Dashboard"

    msg_info "Restoring Data"
@@ -24,7 +24,6 @@ fetch_and_deploy_gh_release "Heimdall" "linuxserver/Heimdall" "tarball"
 msg_info "Setting up Heimdall-Dashboard"
 cd /opt/Heimdall
 cp .env.example .env
-sed -i 's/^APP_ENV=.*/APP_ENV=production/' .env
 $STD php artisan key:generate
 msg_ok "Setup Heimdall-Dashboard"

@@ -7732,6 +7732,16 @@ setup_nodejs() {
    fi
  fi

+  # npm >=11 skips native-module install/rebuild scripts (better-sqlite3, bcrypt,
+  # argon2, ...) unless each package is explicitly allowlisted, silently leaving
+  # native deps unbuilt. Bypass the policy globally instead of allowlisting
+  # per script.
+  local npm_major
+  npm_major=$(npm -v 2>/dev/null | cut -d. -f1)
+  if [[ "${npm_major:-0}" -ge 11 ]]; then
+    $STD npm config set dangerously-allow-all-scripts true --location=global 2>/dev/null || true
+  fi
+
  # Set a safe default heap limit for Node.js builds if not explicitly provided.
  # Priority:
  #   1) NODE_OPTIONS (caller/user override)