Allow Script and UI5 tooling

Problem

When you bootstrap a Fiori app via yo @sap/fiori you might get the message that packages had an install script blocked.

npm warn install-scripts 2 packages had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts   fsevents@2.3.3 (install: (install scripts present))
npm warn install-scripts   ui5-tooling-transpile@3.14.1 (postinstall: node ./lib/postinstall.js)
npm warn install-scripts
npm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.

Root Cause

NPM 12 came with a breaking change 🔗. NPM is now forbidding packages to simply run a script when installed (Release Notes 🔗). In case a package wants to run preinstall, install, or postinstall, this is since July 2026 and NPM 12 not possible.

Solution

You need to opt-in: explicitly allow the package to run the scripts. This is a security measure. The approach for the developer to get this solved is to see which packages were blocked, validate them, and if approved, add the to the exception list and install the package.

Get list of blocked package

To see which packages need to be allowed, run:

npm approve-scripts --allow-scripts-pending

Output

2 packages have install scripts blocked because they are not covered by allowScripts:
  fsevents@2.3.3 (install: (install scripts present))
  ui5-tooling-transpile@3.14.1 (postinstall: node ./lib/postinstall.js)

Approve package

If you approve those packages, run:

npm approve-scripts <package>
npm approve-scripts ui5-tooling-transpile  # approve ui5-tooling-transpile

Output

Approved ui5-tooling-transpile:
  added ui5-tooling-transpile@3.14.1

Install package

npm i --save-dev ui5-tooling-transpile

Short version

Allow NPM to run the install script.

npm install-scripts approve ui5-tooling-transpile

This adds the package to the allow list in packge.json:

"allowScripts": {
  "ui5-tooling-transpile@3.14.1": true
}

Note

Better would be to not have doing this. I don’t know what scripts ui5-tooling-transpile is running, nor why. For creating a Fiori project, I am not even sure I should know. Maybe the packages can be added to an allow list in the package.json template? Or make the packages needed for the Fiori / UI5 project templates not depending on install scripts?

It's full of stars