Prossime modifiche sostanziali per NPM v12

<p># Upcoming breaking changes for npm v12</p><p>Our next npm major version, v12, introduces security-related default changes to `npm install`</p><p>. All these changes are available behind warnings in npm today on 11.16.0 or newer, so you can prepare before the upgrade. v12 is estimated to release in July 2026.</p><p>Each change turns an `npm install`</p><p>behavior that runs automatically today into one you explicitly opt into:</p><p>`allowScripts`</p><p>defaults to off:`npm install`</p><p>will no longer execute`preinstall`</p><p>,`install`</p><p>, or`postinstall`</p><p>scripts from dependencies unless they are explicitly allowed in your project. This includes native`node-gyp`</p><p>builds (i.e., a package with a`binding.gyp`</p><p>and no explicit install script still gets blocked, because npm runs an implicit`node-gyp rebuild`</p><p>for it).`prepare`</p><p>scripts from git, file, and link dependencies are blocked the same way. To see what would be blocked, run`npm approve-scripts --allow-scripts-pending`</p><p>. Then allow the packages you trust with`npm approve-scripts`</p><p>and block the rest with`npm deny-scripts`</p><p>. The resulting allowlist is written to`package.json`</p><p>and should be committed. If your install routine runs scripts, you can observe warnings in npm 11.16.0+.-<br>`--allow-git`</p><p>defaults to`none`</p><p>:`npm install`</p><p>will no longer resolve Git dependencies (direct or transitive) unless explicitly allowed via`--allow-git`</p><p>. This closes a code-execution path where a Git dependency’s`.npmrc`</p><p>could override the Git executable, even with`--ignore-scripts`</p><p>. This change was previously announced on 2026-02-18 and is available in npm 11.10.0+. -<br>`--allow-remote`</p><p>defaults to`none`</p><p>:`npm install`</p><p>will no longer resolve dependencies from remote URLs, such as https tarballs (direct or transitive), unless explicitly allowed via`--allow-remote`</p><p>. This flag is available in npm 11.15.0+. The related`--allow-file`</p><p>and`--allow-directory`</p><p>flags are not changing their defaults in v12.</p><p>### How to prepare</p><p>Upgrade to npm 11.16.0 or later, run your normal install, and review the warnings. Use `npm approve-scripts --allow-scripts-pending`</p><p>to see which packages have scripts, approve the ones you trust, and commit the updated `package.json`</p><p>. After that, only the scripts you approved keep running once you upgrade. Anything you leave unapproved will stop. More details are available in our docs at `npm approve-scripts`</p><p>, `npm deny-scripts`</p><p>, and `allow-scripts`</p><p>config (for `npx`</p><p>and global installs). Please share your comments and questions in our community discussion.</p>