setup_nodejs: bypass npm allowScripts policy globally on npm >=11

CHANGELOG.md

@@ -518,28 +518,16 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-08-05
-
-### 🚀 Updated Scripts
-
-  - NextcloudPI: Bump to Debian Trixie & Tweak broken SSH [@MickLesk](https://github.com/MickLesk) ([#15957](https://github.com/community-scripts/ProxmoxVE/pull/15957))
-
 ## 2026-08-04
 
 ### 🆕 New Scripts
 
-  - Hister ([#16259](https://github.com/community-scripts/ProxmoxVE/pull/16259))
+  - Obsidian-LiveSync ([#16233](https://github.com/community-scripts/ProxmoxVE/pull/16233))
-- Obsidian-LiveSync ([#16233](https://github.com/community-scripts/ProxmoxVE/pull/16233))
 
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
-    - Actual Budget: allow native module install scripts under npm 11 (Node24) [@MickLesk](https://github.com/MickLesk) ([#16277](https://github.com/community-scripts/ProxmoxVE/pull/16277))
-    - Heimdall-Dashboard: run full composer install on update, force production env [@MickLesk](https://github.com/MickLesk) ([#16278](https://github.com/community-scripts/ProxmoxVE/pull/16278))
-    - xyOps: rebuild xySat satellite during update [@MickLesk](https://github.com/MickLesk) ([#16279](https://github.com/community-scripts/ProxmoxVE/pull/16279))
-    - HAOS: remove non-ASCII dash from CPU model dialog text [@MickLesk](https://github.com/MickLesk) ([#16276](https://github.com/community-scripts/ProxmoxVE/pull/16276))
-    - fix: back up Termix db/data so the update stops destroying encryption keys [@LukeGus](https://github.com/LukeGus) ([#16275](https://github.com/community-scripts/ProxmoxVE/pull/16275))
     - passwordpusher: dynamically read Ruby version from .ruby-version file [@Copilot](https://github.com/Copilot) ([#16242](https://github.com/community-scripts/ProxmoxVE/pull/16242))
     - fix(salt): write version cache to ~/.salt, not /~.salt [@TowyTowy](https://github.com/TowyTowy) ([#16265](https://github.com/community-scripts/ProxmoxVE/pull/16265))
     - AFFiNE: fix version and build type reported by the app itself [@MickLesk](https://github.com/MickLesk) ([#16251](https://github.com/community-scripts/ProxmoxVE/pull/16251))

ct/actualbudget.sh

@@ -39,9 +39,7 @@ function update_script() {
       msg_ok "Stopped Service"
 
       msg_info "Updating Actual Budget to ${RELEASE}"
-      $STD npm config set allow-scripts=bcrypt,better-sqlite3,argon2 --location=global
       $STD npm update -g @actual-app/sync-server
-      $STD npm rebuild -g
       echo "${RELEASE}" >~/.actualbudget
       msg_ok "Updated Actual Budget to ${RELEASE}"
 

ct/headers/hister

@@ -1,6 +0,0 @@
-    __  ___      __           
-   / / / (_)____/ /____  _____
-  / /_/ / / ___/ __/ _ \/ ___/
- / __  / (__  ) /_/  __/ /    
-/_/ /_/_/____/\__/\___/_/     
-                              

ct/heimdall-dashboard.sh

@@ -46,11 +46,8 @@ function update_script() {
 
     msg_info "Updating Heimdall-Dashboard"
     cd /opt/Heimdall
-    sed -i 's/^APP_ENV=.*/APP_ENV=production/' .env
-    rm -f bootstrap/cache/*.php
     export COMPOSER_ALLOW_SUPERUSER=1
-    $STD composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader
+    $STD composer dump-autoload
-    $STD php artisan optimize:clear
     msg_ok "Updated Heimdall-Dashboard"
 
     msg_info "Restoring Data"

ct/hister.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/asciimoo/hister
-
-APP="Hister"
-var_tags="${var_tags:-search;browser-history;personal}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /usr/local/bin/hister ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "hister" "asciimoo/hister"; then
-    msg_info "Stopping Service"
-    systemctl stop hister
-    msg_ok "Stopped Service"
-
-    fetch_and_deploy_gh_release "hister" "asciimoo/hister" "singlefile" "latest" "/usr/local/bin" "hister_*_linux_$(arch_resolve)"
-
-    msg_info "Starting Service"
-    systemctl start hister
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:4433${CL}"

ct/nextcloudpi.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
+var_version="${var_version:-12}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/termix.sh

@@ -112,33 +112,14 @@ EOF
     msg_ok "Stopped Termix"
 
     msg_info "Migrating Configuration"
-    mkdir -p /opt/termix/db/data
+    if [[ ! -f /opt/termix/.env ]]; then
-
-    if [[ -f /opt/termix/data/db.sqlite.encrypted && ! -f /opt/termix/db/data/db.sqlite.encrypted ]]; then
-      cp -a /opt/termix/data/db.sqlite.encrypted /opt/termix/db/data/db.sqlite.encrypted
-      [[ -f /opt/termix/data/db.sqlite.encrypted.meta ]] &&
-        cp -a /opt/termix/data/db.sqlite.encrypted.meta /opt/termix/db/data/db.sqlite.encrypted.meta
-      [[ -f /opt/termix/data/db.sqlite ]] &&
-        cp -a /opt/termix/data/db.sqlite /opt/termix/db/data/db.sqlite
-    fi
-
-    if [[ -f /opt/termix/data/.env && ! -f /opt/termix/db/data/.env ]]; then
-      cp -a /opt/termix/data/.env /opt/termix/db/data/.env
-    fi
-
-    for sub in ssl session_logs session_recordings acme-webroot certbot uploads; do
-      if [[ -d /opt/termix/data/$sub && ! -d /opt/termix/db/data/$sub ]]; then
-        cp -a "/opt/termix/data/$sub" "/opt/termix/db/data/$sub"
-      fi
-    done
-
       cat <<EOF >/opt/termix/.env
 NODE_ENV=production
-DATA_DIR=/opt/termix/db/data
+DATA_DIR=/opt/termix/data
 GUACD_HOST=127.0.0.1
 GUACD_PORT=4822
 EOF
-
+    fi
     if ! grep -q "EnvironmentFile" /etc/systemd/system/termix.service 2>/dev/null; then
       cat <<EOF >/etc/systemd/system/termix.service
 [Unit]
@@ -162,11 +143,7 @@ EOF
     fi
     msg_ok "Migrated Configuration"
 
-    create_backup \
+    create_backup /opt/termix/data /opt/termix/uploads /opt/termix/.env
-      /opt/termix/db/data \
-      /opt/termix/data \
-      /opt/termix/uploads \
-      /opt/termix/.env
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
 
@@ -181,10 +158,10 @@ EOF
       /opt/termix/db/data
     msg_ok "Recreated Directories"
 
-    if [[ -f /opt/termix/db/data/db.sqlite.encrypted && ! -f /opt/termix/db/data/.env ]]; then
+    if [[ -f /opt/termix/data/db.sqlite.encrypted && ! -f /opt/termix/db/data/db.sqlite.encrypted ]]; then
-      msg_error "Encrypted database restored without its keys (/opt/termix/db/data/.env is missing)"
+      msg_info "Migrating Database to new layout"
-      msg_custom "🛟" "Restore the container from a backup and report this at https://github.com/community-scripts/ProxmoxVE/issues"
+      cp -a /opt/termix/data/db.sqlite.encrypted /opt/termix/db/data/db.sqlite.encrypted
-      exit 1
+      msg_ok "Migrated Database to new layout"
     fi
 
     msg_info "Building Frontend"
@@ -260,12 +237,7 @@ EOF
     fi
 
     msg_info "Starting Termix"
-    systemctl daemon-reload
+    systemctl start termix
-    if ! systemctl start termix; then
-      msg_error "Termix failed to start"
-      journalctl -u termix -n 30 --no-pager || true
-      exit 1
-    fi
     msg_ok "Started Termix"
     msg_ok "Updated successfully!"
   fi

ct/xyops.sh

@@ -48,13 +48,6 @@ function update_script() {
     chmod 644 /opt/xyops/node_modules/useragent-ng/lib/regexps.js
     msg_ok "Rebuilt Application"
 
-    fetch_and_deploy_gh_release "xysat" "pixlcore/xysat" "tarball" "latest" "/opt/xyops/satellite"
-
-    msg_info "Building xySat Satellite"
-    cd /opt/xyops/satellite
-    $STD npm install
-    msg_ok "Built xySat Satellite"
-
     msg_info "Starting Service"
     systemctl start xyops
     msg_ok "Started Service"

install/actualbudget-install.sh

@@ -51,7 +51,6 @@ cat <<EOF >/opt/actualbudget-data/config.json
 EOF
 mkdir -p /opt/actualbudget
 cd /opt/actualbudget
-$STD npm config set allow-scripts=bcrypt,better-sqlite3,argon2 --location=global
 $STD npm install --location=global @actual-app/sync-server
 echo "${RELEASE}" >~/.actualbudget
 msg_ok "Installed Actual Budget"

install/heimdall-dashboard-install.sh

@@ -24,7 +24,6 @@ fetch_and_deploy_gh_release "Heimdall" "linuxserver/Heimdall" "tarball"
 msg_info "Setting up Heimdall-Dashboard"
 cd /opt/Heimdall
 cp .env.example .env
-sed -i 's/^APP_ENV=.*/APP_ENV=production/' .env
 $STD php artisan key:generate
 msg_ok "Setup Heimdall-Dashboard"
 

install/hister-install.sh

@@ -1,51 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/asciimoo/hister
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-fetch_and_deploy_gh_release "hister" "asciimoo/hister" "singlefile" "latest" "/usr/local/bin" "hister_*_linux_$(arch_resolve)"
-
-msg_info "Configuring Hister"
-mkdir -p /opt/hister/data /etc/hister
-LOCAL_IP=$(hostname -I | awk '{print $1}')
-cat <<EOF >/etc/hister/config.yaml
-app:
-  directory: '/opt/hister/data'
-server:
-  address: '0.0.0.0:4433'
-  base_url: 'http://${LOCAL_IP}:4433'
-EOF
-msg_ok "Configured Hister"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/hister.service
-[Unit]
-Description=Hister Search Engine
-After=network.target
-
-[Service]
-Type=simple
-User=root
-ExecStart=/usr/local/bin/hister listen --config /etc/hister/config.yaml
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now hister
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc

install/nextcloudpi-install.sh

@@ -24,11 +24,6 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
   exit 10
 fi
 
-msg_info "Switching SSH to classic (non-socket-activated) mode"
-systemctl disable --now ssh.socket &>/dev/null || true
-systemctl enable --now ssh &>/dev/null || true
-msg_ok "Switched SSH to classic mode"
-
 msg_info "Installing NextCloudPi (Patience)"
 $STD bash <(curl -fsSL https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh)
 msg_ok "Installed NextCloudPi"

install/termix-install.sh

@@ -125,7 +125,7 @@ EOF
 
 cat <<EOF >/opt/termix/.env
 NODE_ENV=production
-DATA_DIR=/opt/termix/db/data
+DATA_DIR=/opt/termix/data
 GUACD_HOST=127.0.0.1
 GUACD_PORT=4822
 EOF

misc/tools.func

@@ -7732,6 +7732,16 @@ setup_nodejs() {
     fi
   fi
 
+  # npm >=11 skips native-module install/rebuild scripts (better-sqlite3, bcrypt,
+  # argon2, ...) unless each package is explicitly allowlisted, silently leaving
+  # native deps unbuilt. Bypass the policy globally instead of allowlisting
+  # per script.
+  local npm_major
+  npm_major=$(npm -v 2>/dev/null | cut -d. -f1)
+  if [[ "${npm_major:-0}" -ge 11 ]]; then
+    $STD npm config set dangerously-allow-all-scripts true --location=global 2>/dev/null || true
+  fi
+
   # Set a safe default heap limit for Node.js builds if not explicitly provided.
   # Priority:
   #   1) NODE_OPTIONS (caller/user override)

vm/haos-vm.sh

@@ -402,7 +402,7 @@ function advanced_settings() {
   fi
 
   if CPU_TYPE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "CPU MODEL" --radiolist "Choose CPU Model" --cancel-button Exit-Script 10 58 2 \
-    "KVM64" "Default - safe for migration/compatibility" ON \
+    "KVM64" "Default – safe for migration/compatibility" ON \
     "Host" "Use host CPU features (faster, no migration)" OFF \
     3>&1 1>&2 2>&3); then
     case "$CPU_TYPE1" in