GitHub published the breaking changes for npm v12 on 9 June 2026, and the short version is that three things npm install does automatically today will become things you have to opt into. allowScripts defaults to off, --allow-git defaults to none, and --allow-remote defaults to none. The npm team frames each change as turning a behaviour that runs automatically today into "one you explicitly opt into." v12 is estimated to release in July 2026, and all three changes are already available behind warnings in npm 11.16.0 or newer — which is the window teams have to prepare before anything breaks.

What actually changes

The throughline is a shift from implicit trust to explicit opt-in across three install-time behaviours.

allowScripts defaults to off means npm install will no longer run a dependency's preinstall, install or postinstall scripts unless that package is explicitly allowed in your project. This is broader than it first sounds: it also covers the implicit node-gyp rebuild that npm runs for any package shipping a binding.gyp, so a native module with no explicit install script is still blocked. prepare scripts from git, file and link dependencies are blocked the same way.

--allow-git defaults to none means npm install will no longer resolve Git dependencies, direct or transitive, unless you allow them. The reason this is a separate control rather than a subset of script-blocking is the interesting part: a Git dependency's .npmrc could override the Git executable itself, which is a code-execution path that persisted even when you ran with --ignore-scripts. In other words, the old --ignore-scripts flag was never the complete fix teams assumed it was. This change has been available since npm 11.10.0 and was first announced on 2026-02-18.

--allow-remote defaults to none means npm install will no longer pull dependencies from remote URLs such as https tarballs, direct or transitive, unless explicitly allowed. It is available in npm 11.15.0 and later. The related --allow-file and --allow-directory flags are not changing their defaults in v12.

What will break

The breakage is concentrated in three places: native modules that compile during install, Git-sourced dependencies, and remote tarball dependencies. Native-module impact depends on the package, platform and version, but anything driven by node-gyp and a binding.gyp deserves review — packages in the better-sqlite3, bcrypt, canvas or sharp category are the kind that may need explicit allowlisting. The trade-off is real friction: projects with native dependencies, Git dependencies or private tarball flows need to inventory those paths before a CI image silently picks up npm v12.

In npm 11.16.0+, the stricter v12 behaviour is previewed through warnings, giving teams a chance to identify what would be blocked before the default actually changes. Some failures will be loud during install or test; others may surface later when a native module or generated artifact is first used. That asymmetry — caught early if you look, missed until runtime if you do not — is the migration risk to plan around.

How to get ahead of it

The preparation path is short and worth doing before July. Upgrade a test branch or CI image to npm 11.16.0 or later, run a normal install, and read the warnings. Use npm approve-scripts --allow-scripts-pending to list the packages that have scripts, approve only the ones you have reviewed with npm approve-scripts, block the rest with npm deny-scripts, and commit the resulting allowlist in package.json. Once you are on v12, only the scripts you approved keep running.

Two practical notes. Do not reach for npm approve-scripts --all to make the warnings go away — it approves everything indiscriminately and throws away the entire point of the allowlist. And because the allowlist lives in the project's package.json, it has to be committed to source control to take effect in CI; it does not carry over to global installs, which use a separate configuration.

Key Takeaways

  • npm v12 (estimated July 2026) flips three npm install defaults from automatic to explicit opt-in: allowScripts off, --allow-git=none, and --allow-remote=none.

  • allowScripts off also blocks the implicit node-gyp rebuild, so native modules with a binding.gyp are affected even without an explicit install script.

  • The --allow-git change closes a code-execution path (a Git dependency's .npmrc overriding the Git executable) that --ignore-scripts did not fully block.

  • Prepare now: upgrade a test branch or CI image to npm 11.16.0+, run npm approve-scripts --allow-scripts-pending, approve only reviewed packages, and commit the allowlist so it applies in CI.