feat: onlyBuiltDependenciesFile (#7167)

close #7137
2025-12-23 23:29:17 -05:00 · 2023-10-08 01:50:47 +03:00
parent ca1c849b38
commit d774a3196c
42 changed files with 288 additions and 102 deletions
--- a/.changeset/many-kids-exist.md
+++ b/.changeset/many-kids-exist.md
@@ -0,0 +1,5 @@
+---
+"@pnpm/config": minor
+---
+
+Add a new setting: rootProjectManifestDir.
--- a/.changeset/nine-ties-pretend.md
+++ b/.changeset/nine-ties-pretend.md
@@ -0,0 +1,34 @@
+---
+"@pnpm/plugin-commands-installation": minor
+"@pnpm/plugin-commands-rebuild": minor
+"@pnpm/headless": minor
+"@pnpm/core": minor
+"@pnpm/types": minor
+"pnpm": minor
+---
+
+The list of packages that are allowed to run installation scripts now may be provided in a separate configuration file. The path to the file should be specified via the `pnpm.onlyBuiltDependenciesFile` field in `package.json`. For instance:
+
+```json
+{
+  "dependencies": {
+    "@my-org/policy": "1.0.0"
+  }
+  "pnpm": {
+    "onlyBuiltDependenciesFile": "node_modules/@my-org/policy/allow-build.json"
+  }
+}
+```
+
+In the example above, the list is loaded from a dependency. The JSON file with the list should contain an array of package names. For instance:
+
+```json
+[
+  "esbuild",
+  "@reflink/reflink"
+]
+```
+
+With the above list, only `esbuild` and `@reflink/reflink` will be allowed to run scripts during installation.
+
+Related issue: [#7137](https://github.com/pnpm/pnpm/issues/7137).
--- a/.changeset/tidy-avocados-vanish.md
+++ b/.changeset/tidy-avocados-vanish.md
@@ -0,0 +1,5 @@
+---
+"@pnpm/build-modules": minor
+---
+
+Accept an allowBuild function to filter which dependencies may run scripts.
--- a/utils/assert-project/package.json
+++ b/utils/assert-project/package.json
@@ -44,7 +44,7 @@
    "@pnpm/constants": "workspace:*",
    "@pnpm/lockfile-types": "workspace:*",
    "@pnpm/modules-yaml": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/types": "workspace:*",
    "is-windows": "^1.0.2",
    "isexe": "2.0.0",
--- a/utils/assert-store/package.json
+++ b/utils/assert-store/package.json
@@ -40,7 +40,7 @@
    "test": "pnpm pretest && pnpm run compile && jest"
  },
  "dependencies": {
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/store.cafs": "workspace:*",
    "path-exists": "^4.0.0"
  },
--- a/config/config/src/Config.ts
+++ b/config/config/src/Config.ts
@@ -169,6 +169,7 @@ export interface Config {

  testPattern?: string[]
  changedFilesIgnorePattern?: string[]
+  rootProjectManifestDir?: string
  rootProjectManifest?: ProjectManifest
  userConfig: Record<string, string>
 }
--- a/pkg-manager/plugin-commands-installation/src/getOptionsFromRootManifest.ts
+++ b/pkg-manager/plugin-commands-installation/src/getOptionsFromRootManifest.ts
@@ -1,3 +1,4 @@
+import path from 'path'
 import { PnpmError } from '@pnpm/error'
 import {
  type AllowedDeprecatedVersions,
@@ -7,16 +8,19 @@ import {
 } from '@pnpm/types'
 import mapValues from 'ramda/src/map'

-export function getOptionsFromRootManifest (manifest: ProjectManifest): {
+export interface OptionsFromRootManifest {
  allowedDeprecatedVersions?: AllowedDeprecatedVersions
  allowNonAppliedPatches?: boolean
  overrides?: Record<string, string>
  neverBuiltDependencies?: string[]
  onlyBuiltDependencies?: string[]
+  onlyBuiltDependenciesFile?: string
  packageExtensions?: Record<string, PackageExtension>
  patchedDependencies?: Record<string, string>
  peerDependencyRules?: PeerDependencyRules
-} {
+}
+
+export function getOptionsFromRootManifest (manifestDir: string, manifest: ProjectManifest): OptionsFromRootManifest {
  // We read Yarn's resolutions field for compatibility
  // but we really replace the version specs to any other version spec, not only to exact versions,
  // so we cannot call it resolutions
@@ -26,12 +30,13 @@ export function getOptionsFromRootManifest (manifest: ProjectManifest): {
  )
  const neverBuiltDependencies = manifest.pnpm?.neverBuiltDependencies
  const onlyBuiltDependencies = manifest.pnpm?.onlyBuiltDependencies
+  const onlyBuiltDependenciesFile = manifest.pnpm?.onlyBuiltDependenciesFile
  const packageExtensions = manifest.pnpm?.packageExtensions
  const peerDependencyRules = manifest.pnpm?.peerDependencyRules
  const allowedDeprecatedVersions = manifest.pnpm?.allowedDeprecatedVersions
  const allowNonAppliedPatches = manifest.pnpm?.allowNonAppliedPatches
  const patchedDependencies = manifest.pnpm?.patchedDependencies
-  const settings = {
+  const settings: OptionsFromRootManifest = {
    allowedDeprecatedVersions,
    allowNonAppliedPatches,
    overrides,
@@ -41,8 +46,10 @@ export function getOptionsFromRootManifest (manifest: ProjectManifest): {
    patchedDependencies,
  }
  if (onlyBuiltDependencies) {
-    // @ts-expect-error
-    settings['onlyBuiltDependencies'] = onlyBuiltDependencies
+    settings.onlyBuiltDependencies = onlyBuiltDependencies
+  }
+  if (onlyBuiltDependenciesFile) {
+    settings.onlyBuiltDependenciesFile = path.join(manifestDir, onlyBuiltDependenciesFile)
  }
  return settings
 }
--- a/config/config/src/index.ts
+++ b/config/config/src/index.ts
@@ -25,6 +25,7 @@ import {
 } from './Config'
 import { getWorkspaceConcurrency } from './concurrency'

+export { getOptionsFromRootManifest, type OptionsFromRootManifest } from './getOptionsFromRootManifest'
 export * from './readLocalConfig'

 export type { Config, UniversalOptions }
@@ -548,7 +549,8 @@ export async function getConfig (
  if (!pnpmConfig.ignorePnpmfile) {
    pnpmConfig.hooks = requireHooks(pnpmConfig.lockfileDir ?? pnpmConfig.dir, pnpmConfig)
  }
-  pnpmConfig.rootProjectManifest = await safeReadProjectManifestOnly(pnpmConfig.lockfileDir ?? pnpmConfig.workspaceDir ?? pnpmConfig.dir) ?? undefined
+  pnpmConfig.rootProjectManifestDir = pnpmConfig.lockfileDir ?? pnpmConfig.workspaceDir ?? pnpmConfig.dir
+  pnpmConfig.rootProjectManifest = await safeReadProjectManifestOnly(pnpmConfig.rootProjectManifestDir) ?? undefined
  if (pnpmConfig.rootProjectManifest?.workspaces?.length && !pnpmConfig.workspaceDir) {
    warnings.push('The "workspaces" field in package.json is not supported by pnpm. Create a "pnpm-workspace.yaml" file instead.')
  }
--- a/pkg-manager/plugin-commands-installation/test/getOptionsFromRootManifest.test.ts
+++ b/pkg-manager/plugin-commands-installation/test/getOptionsFromRootManifest.test.ts
@@ -1,7 +1,7 @@
 import { getOptionsFromRootManifest } from '../lib/getOptionsFromRootManifest'

 test('getOptionsFromRootManifest() should read "resolutions" field for compatibility with Yarn', () => {
-  const options = getOptionsFromRootManifest({
+  const options = getOptionsFromRootManifest(process.cwd(), {
    resolutions: {
      foo: '1.0.0',
    },
@@ -10,7 +10,7 @@ test('getOptionsFromRootManifest() should read "resolutions" field for compatibi
 })

 test('getOptionsFromRootManifest() should read "overrides" field', () => {
-  const options = getOptionsFromRootManifest({
+  const options = getOptionsFromRootManifest(process.cwd(), {
    pnpm: {
      overrides: {
        foo: '1.0.0',
@@ -21,7 +21,7 @@ test('getOptionsFromRootManifest() should read "overrides" field', () => {
 })

 test('getOptionsFromRootManifest() Support $ in overrides by dependencies', () => {
-  const options = getOptionsFromRootManifest({
+  const options = getOptionsFromRootManifest(process.cwd(), {
    dependencies: {
      foo: '1.0.0',
    },
@@ -35,7 +35,7 @@ test('getOptionsFromRootManifest() Support $ in overrides by dependencies', () =
 })

 test('getOptionsFromRootManifest() Support $ in overrides by devDependencies', () => {
-  const options = getOptionsFromRootManifest({
+  const options = getOptionsFromRootManifest(process.cwd(), {
    devDependencies: {
      foo: '1.0.0',
    },
@@ -49,7 +49,7 @@ test('getOptionsFromRootManifest() Support $ in overrides by devDependencies', (
 })

 test('getOptionsFromRootManifest() Support $ in overrides by dependencies and devDependencies', () => {
-  const options = getOptionsFromRootManifest({
+  const options = getOptionsFromRootManifest(process.cwd(), {
    dependencies: {
      foo: '1.0.0',
    },
@@ -66,7 +66,7 @@ test('getOptionsFromRootManifest() Support $ in overrides by dependencies and de
 })

 test('getOptionsFromRootManifest() throws an error if cannot resolve an override version reference', () => {
-  expect(() => getOptionsFromRootManifest({
+  expect(() => getOptionsFromRootManifest(process.cwd(), {
    dependencies: {
      bar: '1.0.0',
    },
--- a/exec/build-modules/src/buildSequence.ts
+++ b/exec/build-modules/src/buildSequence.ts
@@ -5,6 +5,7 @@ import filter from 'ramda/src/filter'
 export interface DependenciesGraphNode {
  children: Record<string, string>
  depPath: string
+  name: string
  dir: string
  fetchingBundledManifest?: () => Promise<PackageManifest | undefined>
  filesIndexFile: string
--- a/exec/build-modules/src/index.ts
+++ b/exec/build-modules/src/index.ts
@@ -20,6 +20,7 @@ export async function buildModules (
  depGraph: DependenciesGraph,
  rootDepPaths: string[],
  opts: {
+    allowBuild?: (pkgName: string) => boolean
    childConcurrency?: number
    depsToBuild?: Set<string>
    depsStateCache: DepsStateCache
@@ -53,6 +54,7 @@ export async function buildModules (
    warn,
  }
  const chunks = buildSequence(depGraph, rootDepPaths)
+  const allowBuild = opts.allowBuild ?? (() => true)
  const groups = chunks.map((chunk) => {
    chunk = chunk.filter((depPath) => {
      const node = depGraph[depPath]
@@ -63,7 +65,12 @@ export async function buildModules (
    }

    return chunk.map((depPath: string) =>
-      async () => buildDependency(depPath, depGraph, buildDepOpts)
+      async () => {
+        return buildDependency(depPath, depGraph, {
+          ...buildDepOpts,
+          ignoreScripts: Boolean(buildDepOpts.ignoreScripts) || !allowBuild(depGraph[depPath].name),
+        })
+      }
    )
  })
  await runGroups(opts.childConcurrency ?? 4, groups)
--- a/exec/plugin-commands-rebuild/package.json
+++ b/exec/plugin-commands-rebuild/package.json
@@ -34,7 +34,7 @@
    "@pnpm/filter-workspace-packages": "workspace:*",
    "@pnpm/plugin-commands-rebuild": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/test-fixtures": "workspace:*",
    "@types/ramda": "0.28.20",
    "@types/semver": "7.3.13",
@@ -45,7 +45,7 @@
    "write-yaml-file": "^5.0.0"
  },
  "dependencies": {
-    "@pnpm/builder.policy": "1.0.0",
+    "@pnpm/builder.policy": "1.1.0",
    "@pnpm/calc-dep-state": "workspace:*",
    "@pnpm/cli-utils": "workspace:*",
    "@pnpm/common-cli-options-help": "workspace:*",
--- a/exec/plugin-commands-rebuild/src/implementation/extendRebuildOptions.ts
+++ b/exec/plugin-commands-rebuild/src/implementation/extendRebuildOptions.ts
@@ -1,4 +1,5 @@
 import path from 'path'
+import { type Config, getOptionsFromRootManifest } from '@pnpm/config'
 import { type LogBase } from '@pnpm/logger'
 import { normalizeRegistries, DEFAULT_REGISTRIES } from '@pnpm/normalize-registries'
 import { type StoreController } from '@pnpm/store-controller-types'
@@ -50,7 +51,7 @@ export interface StrictRebuildOptions {
 }

 export type RebuildOptions = Partial<StrictRebuildOptions> &
-Pick<StrictRebuildOptions, 'storeDir' | 'storeController'>
+Pick<StrictRebuildOptions, 'storeDir' | 'storeController'> & Pick<Config, 'rootProjectManifest' | 'rootProjectManifestDir'>

 const defaults = async (opts: RebuildOptions) => {
  const packageManager = opts.packageManager ??
@@ -96,7 +97,12 @@ export async function extendRebuildOptions (
    }
  }
  const defaultOpts = await defaults(opts)
-  const extendedOpts = { ...defaultOpts, ...opts, storeDir: defaultOpts.storeDir }
+  const extendedOpts = {
+    ...defaultOpts,
+    ...opts,
+    storeDir: defaultOpts.storeDir,
+    ...(opts.rootProjectManifest ? getOptionsFromRootManifest(opts.rootProjectManifestDir!, opts.rootProjectManifest) : {}),
+  }
  extendedOpts.registries = normalizeRegistries(extendedOpts.registries)
  return extendedOpts
 }
--- a/exec/plugin-commands-script-runners/package.json
+++ b/exec/plugin-commands-script-runners/package.json
@@ -34,7 +34,7 @@
    "@pnpm/filter-workspace-packages": "workspace:*",
    "@pnpm/plugin-commands-script-runners": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@types/is-windows": "^1.0.0",
    "@types/ramda": "0.28.20",
    "@types/which": "^2.0.2",
--- a/package.json
+++ b/package.json
@@ -38,7 +38,7 @@
    "@commitlint/prompt-cli": "^17.7.1",
    "@pnpm/eslint-config": "workspace:*",
    "@pnpm/meta-updater": "1.0.0",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/tsconfig": "workspace:*",
    "@pnpm/worker": "workspace:*",
    "@types/jest": "^29.5.5",
--- a/packages/types/src/package.ts
+++ b/packages/types/src/package.ts
@@ -126,6 +126,7 @@ export type ProjectManifest = BaseManifest & {
  pnpm?: {
    neverBuiltDependencies?: string[]
    onlyBuiltDependencies?: string[]
+    onlyBuiltDependenciesFile?: string
    overrides?: Record<string, string>
    packageExtensions?: Record<string, PackageExtension>
    peerDependencyRules?: PeerDependencyRules
--- a/patching/plugin-commands-patching/package.json
+++ b/patching/plugin-commands-patching/package.json
@@ -34,7 +34,7 @@
    "@pnpm/filter-workspace-packages": "workspace:*",
    "@pnpm/plugin-commands-patching": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/test-fixtures": "workspace:*",
    "@types/normalize-path": "^3.0.0",
    "@types/npm-packlist": "^3.0.0",
--- a/patching/plugin-commands-patching/src/patchCommit.ts
+++ b/patching/plugin-commands-patching/src/patchCommit.ts
@@ -86,6 +86,7 @@ export async function handler (opts: install.InstallCommandOptions & Pick<Config

  return install.handler({
    ...opts,
+    rootProjectManifest,
    rawLocalConfig: {
      ...opts.rawLocalConfig,
      'frozen-lockfile': false,
--- a/pkg-manager/core/package.json
+++ b/pkg-manager/core/package.json
@@ -17,7 +17,7 @@
  },
  "dependencies": {
    "@pnpm/build-modules": "workspace:*",
-    "@pnpm/builder.policy": "1.0.0",
+    "@pnpm/builder.policy": "1.1.0",
    "@pnpm/calc-dep-state": "workspace:*",
    "@pnpm/constants": "workspace:*",
    "@pnpm/core-loggers": "workspace:*",
@@ -81,7 +81,7 @@
    "@pnpm/lockfile-types": "workspace:*",
    "@pnpm/package-store": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/store-path": "workspace:*",
    "@pnpm/store.cafs": "workspace:*",
    "@pnpm/test-fixtures": "workspace:*",
--- a/pkg-manager/core/src/install/extendInstallOptions.ts
+++ b/pkg-manager/core/src/install/extendInstallOptions.ts
@@ -63,6 +63,7 @@ export interface StrictInstallOptions {
  engineStrict: boolean
  neverBuiltDependencies?: string[]
  onlyBuiltDependencies?: string[]
+  onlyBuiltDependenciesFile?: string
  nodeExecPath?: string
  nodeLinker: 'isolated' | 'hoisted' | 'pnp'
  nodeVersion: string
--- a/pkg-manager/core/src/install/index.ts
+++ b/pkg-manager/core/src/install/index.ts
@@ -1004,7 +1004,8 @@ const _installInContext: InstallFunction = async (projects, ctx, opts) => {
  } = await resolveDependencies(
    projects,
    {
-      allowBuild: createAllowBuildFunction(opts),
+      // In the next major allow build should be just () => true here always
+      allowBuild: opts.onlyBuiltDependenciesFile ? () => true : createAllowBuildFunction({ onlyBuiltDependencies: opts.onlyBuiltDependencies, neverBuiltDependencies: opts.neverBuiltDependencies }),
      allowedDeprecatedVersions: opts.allowedDeprecatedVersions,
      allowNonAppliedPatches: opts.allowNonAppliedPatches,
      autoInstallPeers: opts.autoInstallPeers,
@@ -1165,6 +1166,7 @@ const _installInContext: InstallFunction = async (projects, ctx, opts) => {
          }
        }
        await buildModules(dependenciesGraph, rootNodes, {
+          allowBuild: createAllowBuildFunction(opts),
          childConcurrency: opts.childConcurrency,
          depsStateCache,
          depsToBuild: new Set(result.newDepPaths),
--- a/pkg-manager/core/test/install/lifecycleScripts.ts
+++ b/pkg-manager/core/test/install/lifecycleScripts.ts
@@ -465,6 +465,49 @@ test('selectively allow scripts in some dependencies by onlyBuiltDependencies',
  expect(await exists('node_modules/@pnpm.e2e/install-script-example/generated-by-install.js')).toBeTruthy()
 })

+test('selectively allow scripts in some dependencies by onlyBuiltDependenciesFile', async () => {
+  prepareEmpty()
+  const onlyBuiltDependenciesFile = path.resolve('node_modules/@pnpm.e2e/build-allow-list/list.json')
+  const manifest = await addDependenciesToPackage({},
+    ['@pnpm.e2e/build-allow-list', '@pnpm.e2e/pre-and-postinstall-scripts-example@1.0.0', '@pnpm.e2e/install-script-example'],
+    await testDefaults({ fastUnpack: false, onlyBuiltDependenciesFile })
+  )
+
+  expect(await exists('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-preinstall.js')).toBeFalsy()
+  expect(await exists('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-postinstall.js')).toBeFalsy()
+  expect(await exists('node_modules/@pnpm.e2e/install-script-example/generated-by-install.js')).toBeTruthy()
+
+  await rimraf('node_modules')
+
+  await install(manifest, await testDefaults({ fastUnpack: false, frozenLockfile: true, onlyBuiltDependenciesFile }))
+
+  expect(await exists('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-preinstall.js')).toBeFalsy()
+  expect(await exists('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-postinstall.js')).toBeFalsy()
+  expect(await exists('node_modules/@pnpm.e2e/install-script-example/generated-by-install.js')).toBeTruthy()
+})
+
+test('selectively allow scripts in some dependencies by onlyBuiltDependenciesFile and onlyBuiltDependencies', async () => {
+  prepareEmpty()
+  const onlyBuiltDependenciesFile = path.resolve('node_modules/@pnpm.e2e/build-allow-list/list.json')
+  const onlyBuiltDependencies = ['@pnpm.e2e/pre-and-postinstall-scripts-example']
+  const manifest = await addDependenciesToPackage({},
+    ['@pnpm.e2e/build-allow-list', '@pnpm.e2e/pre-and-postinstall-scripts-example@1.0.0', '@pnpm.e2e/install-script-example'],
+    await testDefaults({ fastUnpack: false, onlyBuiltDependenciesFile, onlyBuiltDependencies })
+  )
+
+  expect(await exists('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-preinstall.js')).toBeTruthy()
+  expect(await exists('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-postinstall.js')).toBeTruthy()
+  expect(await exists('node_modules/@pnpm.e2e/install-script-example/generated-by-install.js')).toBeTruthy()
+
+  await rimraf('node_modules')
+
+  await install(manifest, await testDefaults({ fastUnpack: false, frozenLockfile: true, onlyBuiltDependenciesFile, onlyBuiltDependencies }))
+
+  expect(await exists('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-preinstall.js')).toBeTruthy()
+  expect(await exists('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-postinstall.js')).toBeTruthy()
+  expect(await exists('node_modules/@pnpm.e2e/install-script-example/generated-by-install.js')).toBeTruthy()
+})
+
 test('lockfile is updated if neverBuiltDependencies is changed', async () => {
  const project = prepareEmpty()
  const manifest = await addDependenciesToPackage({},
--- a/pkg-manager/headless/package.json
+++ b/pkg-manager/headless/package.json
@@ -22,7 +22,7 @@
    "@pnpm/package-store": "workspace:*",
    "@pnpm/prepare": "workspace:*",
    "@pnpm/read-projects-context": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/store-path": "workspace:*",
    "@pnpm/store.cafs": "workspace:*",
    "@pnpm/test-fixtures": "workspace:*",
@@ -64,6 +64,7 @@
  },
  "dependencies": {
    "@pnpm/build-modules": "workspace:*",
+    "@pnpm/builder.policy": "1.1.0",
    "@pnpm/calc-dep-state": "workspace:*",
    "@pnpm/constants": "workspace:*",
    "@pnpm/core-loggers": "workspace:*",
--- a/pkg-manager/headless/src/index.ts
+++ b/pkg-manager/headless/src/index.ts
@@ -1,6 +1,7 @@
 import { promises as fs } from 'fs'
 import path from 'path'
 import { buildModules } from '@pnpm/build-modules'
+import { createAllowBuildFunction } from '@pnpm/builder.policy'
 import { calcDepState, type DepsStateCache } from '@pnpm/calc-dep-state'
 import {
  LAYOUT_VERSION,
@@ -93,6 +94,9 @@ export interface Project {
 }

 export interface HeadlessOptions {
+  neverBuiltDependencies?: string[]
+  onlyBuiltDependencies?: string[]
+  onlyBuiltDependenciesFile?: string
  autoInstallPeers?: boolean
  childConcurrency?: number
  currentLockfile?: Lockfile
@@ -488,6 +492,7 @@ export async function headlessInstall (opts: HeadlessOptions): Promise<Installat
      }
    }
    await buildModules(graph, Array.from(directNodes), {
+      allowBuild: createAllowBuildFunction(opts),
      childConcurrency: opts.childConcurrency,
      extraBinPaths,
      extraEnv,
--- a/pkg-manager/package-requester/package.json
+++ b/pkg-manager/package-requester/package.json
@@ -61,7 +61,7 @@
    "@pnpm/client": "workspace:*",
    "@pnpm/create-cafs-store": "workspace:*",
    "@pnpm/package-requester": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/test-fixtures": "workspace:*",
    "@types/normalize-path": "^3.0.0",
    "@types/ramda": "0.28.20",
--- a/pkg-manager/plugin-commands-installation/package.json
+++ b/pkg-manager/plugin-commands-installation/package.json
@@ -34,7 +34,7 @@
    "@pnpm/modules-yaml": "workspace:*",
    "@pnpm/plugin-commands-installation": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/test-fixtures": "workspace:*",
    "@types/proxyquire": "^1.3.28",
    "@types/ramda": "0.28.20",
--- a/pkg-manager/plugin-commands-installation/src/import/index.ts
+++ b/pkg-manager/plugin-commands-installation/src/import/index.ts
@@ -9,7 +9,7 @@ import {
 } from '@pnpm/store-connection-manager'
 import gfs from '@pnpm/graceful-fs'
 import { install, type InstallOptions } from '@pnpm/core'
-import { type Config } from '@pnpm/config'
+import { type Config, getOptionsFromRootManifest } from '@pnpm/config'
 import { findWorkspacePackages } from '@pnpm/workspace.find-packages'
 import { type Project } from '@pnpm/types'
 import { logger } from '@pnpm/logger'
@@ -22,7 +22,6 @@ import { parse as parseYarnLock, type LockFileObject } from '@yarnpkg/lockfile'
 import * as yarnCore from '@yarnpkg/core'
 import { parseSyml } from '@yarnpkg/parsers'
 import exists from 'path-exists'
-import { getOptionsFromRootManifest } from '../getOptionsFromRootManifest'
 import { recursive } from '../recursive'
 import { yarnLockFileKeyNormalizer } from './yarnUtil'

@@ -101,6 +100,7 @@ export type ImportCommandOptions = Pick<Config,
 | 'disallowWorkspaceCycles'
 | 'sharedWorkspaceLockfile'
 | 'rootProjectManifest'
+| 'rootProjectManifestDir'
 > & CreateStoreControllerOptions & Omit<InstallOptions, 'storeController' | 'lockfileOnly' | 'preferredVersions'>

 export async function handler (
@@ -169,9 +169,10 @@ export async function handler (

  const store = await createOrConnectStoreController(opts)
  const manifest = await readProjectManifestOnly(opts.dir)
+  const manifestOpts = opts.rootProjectManifest ? getOptionsFromRootManifest(opts.rootProjectManifestDir!, opts.rootProjectManifest) : {}
  const installOpts = {
    ...opts,
-    ...getOptionsFromRootManifest({ ...opts.rootProjectManifest, ...manifest }),
+    ...manifestOpts,
    lockfileOnly: true,
    preferredVersions,
    storeController: store.ctrl,
--- a/pkg-manager/plugin-commands-installation/src/install.ts
+++ b/pkg-manager/plugin-commands-installation/src/install.ts
@@ -270,6 +270,7 @@ export type InstallCommandOptions = Pick<Config,
 | 'preferFrozenLockfile'
 | 'production'
 | 'registries'
+| 'rootProjectManifest'
 | 'save'
 | 'saveDev'
 | 'saveExact'
--- a/pkg-manager/plugin-commands-installation/src/installDeps.ts
+++ b/pkg-manager/plugin-commands-installation/src/installDeps.ts
@@ -3,7 +3,7 @@ import {
  readProjectManifestOnly,
  tryReadProjectManifest,
 } from '@pnpm/cli-utils'
-import { type Config } from '@pnpm/config'
+import { type Config, getOptionsFromRootManifest } from '@pnpm/config'
 import { PnpmError } from '@pnpm/error'
 import { filterPkgsBySelectorObjects } from '@pnpm/filter-workspace-packages'
 import { arrayOfWorkspacePackagesToMap, findWorkspacePackages } from '@pnpm/workspace.find-packages'
@@ -21,7 +21,6 @@ import { logger } from '@pnpm/logger'
 import { sequenceGraph } from '@pnpm/sort-packages'
 import { createPkgGraph } from '@pnpm/workspace.pkgs-graph'
 import isSubdir from 'is-subdir'
-import { getOptionsFromRootManifest } from './getOptionsFromRootManifest'
 import { getPinnedVersion } from './getPinnedVersion'
 import { getSaveType } from './getSaveType'
 import { getNodeExecPath } from './nodeExecPath'
@@ -58,6 +57,7 @@ export type InstallDepsOptions = Pick<Config,
 | 'production'
 | 'rawLocalConfig'
 | 'registries'
+| 'rootProjectManifestDir'
 | 'rootProjectManifest'
 | 'save'
 | 'saveDev'
@@ -188,7 +188,7 @@ when running add/update with the --workspace option')
        params,
        {
          ...opts,
-          ...getOptionsFromRootManifest(opts.rootProjectManifest ?? {}),
+          ...getOptionsFromRootManifest(opts.rootProjectManifestDir!, opts.rootProjectManifest ?? {}),
          forceHoistPattern,
          forcePublicHoistPattern,
          allProjectsGraph,
@@ -219,9 +219,10 @@ when running add/update with the --workspace option')
  }

  const store = await createOrConnectStoreController(opts)
+  const manifestOpts = opts.rootProjectManifest ? getOptionsFromRootManifest(opts.rootProjectManifestDir!, opts.rootProjectManifest) : {}
  const installOpts: Omit<MutateModulesOptions, 'allProjects'> = {
    ...opts,
-    ...getOptionsFromRootManifest({ ...opts.rootProjectManifest, ...manifest }),
+    ...manifestOpts,
    forceHoistPattern,
    forcePublicHoistPattern,
    // In case installation is done in a multi-package repository
--- a/pkg-manager/plugin-commands-installation/src/link.ts
+++ b/pkg-manager/plugin-commands-installation/src/link.ts
@@ -7,7 +7,7 @@ import {
  tryReadProjectManifest,
 } from '@pnpm/cli-utils'
 import { UNIVERSAL_OPTIONS } from '@pnpm/common-cli-options-help'
-import { type Config, types as allTypes } from '@pnpm/config'
+import { type Config, getOptionsFromRootManifest, types as allTypes } from '@pnpm/config'
 import { PnpmError } from '@pnpm/error'
 import { findWorkspaceDir } from '@pnpm/find-workspace-dir'
 import { arrayOfWorkspacePackagesToMap, findWorkspacePackages } from '@pnpm/workspace.find-packages'
@@ -28,7 +28,6 @@ import pick from 'ramda/src/pick'
 import partition from 'ramda/src/partition'
 import renderHelp from 'render-help'
 import * as installCommand from './install'
-import { getOptionsFromRootManifest } from './getOptionsFromRootManifest'
 import { getSaveType } from './getSaveType'

 // @ts-expect-error
@@ -175,7 +174,7 @@ export async function handler (
      await install(
        await readProjectManifestOnly(dir, opts), {
          ...config,
-          ...getOptionsFromRootManifest(config.rootProjectManifest ?? {}),
+          ...getOptionsFromRootManifest(config.rootProjectManifestDir!, config.rootProjectManifest ?? {}),
          include: {
            dependencies: config.production !== false,
            devDependencies: config.dev !== false,
--- a/pkg-manager/plugin-commands-installation/src/recursive.ts
+++ b/pkg-manager/plugin-commands-installation/src/recursive.ts
@@ -4,7 +4,7 @@ import {
  type RecursiveSummary,
  throwOnCommandFail,
 } from '@pnpm/cli-utils'
-import { type Config, readLocalConfig } from '@pnpm/config'
+import { type Config, getOptionsFromRootManifest, readLocalConfig } from '@pnpm/config'
 import { PnpmError } from '@pnpm/error'
 import { arrayOfWorkspacePackagesToMap } from '@pnpm/workspace.find-packages'
 import { logger } from '@pnpm/logger'
@@ -35,7 +35,6 @@ import isSubdir from 'is-subdir'
 import mem from 'mem'
 import pFilter from 'p-filter'
 import pLimit from 'p-limit'
-import { getOptionsFromRootManifest } from './getOptionsFromRootManifest'
 import { createWorkspaceSpecs, updateToWorkspacePackagesFromManifest } from './updateWorkspaceDependencies'
 import { updateToLatestSpecsFromManifest, createLatestSpecs } from './updateToLatestSpecsFromManifest'
 import { getSaveType } from './getSaveType'
@@ -59,6 +58,7 @@ type RecursiveOptions = CreateStoreControllerOptions & Pick<Config,
 | 'rawLocalConfig'
 | 'registries'
 | 'rootProjectManifest'
+| 'rootProjectManifestDir'
 | 'save'
 | 'saveDev'
 | 'saveExact'
@@ -123,8 +123,9 @@ export async function recursive (
    ? arrayOfWorkspacePackagesToMap(allProjects) as WorkspacePackages
    : {}
  const targetDependenciesField = getSaveType(opts)
+  const rootManifestDir = opts.lockfileDir ?? opts.dir
  const installOpts = Object.assign(opts, {
-    ...getOptionsFromRootManifest(manifestsByPath[opts.lockfileDir ?? opts.dir]?.manifest ?? {}),
+    ...getOptionsFromRootManifest(rootManifestDir, manifestsByPath[rootManifestDir]?.manifest ?? {}),
    allProjects: getAllProjects(manifestsByPath, opts.allProjectsGraph, opts.sort),
    linkWorkspacePackagesDepth: opts.linkWorkspacePackages === 'deep' ? Infinity : opts.linkWorkspacePackages ? 0 : -1,
    ownLifecycleHooksStdio: 'pipe',
@@ -359,12 +360,13 @@ export async function recursive (
        }

        const localConfig = await memReadLocalConfig(rootDir)
+        const optionsFromManifest = opts.rootProjectManifest ? getOptionsFromRootManifest(opts.rootProjectManifestDir!, opts.rootProjectManifest) : {}
        const newManifest = await action(
          manifest,
          {
            ...installOpts,
            ...localConfig,
-            ...getOptionsFromRootManifest({ ...opts.rootProjectManifest, ...manifest }),
+            ...optionsFromManifest,
            bin: path.join(rootDir, 'node_modules', '.bin'),
            dir: rootDir,
            hooks,
@@ -413,7 +415,7 @@ export async function recursive (
  ) {
    await rebuild.handler({
      ...opts,
-      ...getOptionsFromRootManifest(opts.rootProjectManifest ?? {}),
+      ...getOptionsFromRootManifest(opts.rootProjectManifestDir!, opts.rootProjectManifest ?? {}),
      pending: opts.pending === true,
      skipIfHasSideEffectsCache: true,
    }, [])
--- a/pkg-manager/plugin-commands-installation/src/remove.ts
+++ b/pkg-manager/plugin-commands-installation/src/remove.ts
@@ -5,7 +5,7 @@ import {
 } from '@pnpm/cli-utils'
 import { type CompletionFunc } from '@pnpm/command'
 import { FILTERING, OPTIONS, UNIVERSAL_OPTIONS } from '@pnpm/common-cli-options-help'
-import { type Config, types as allTypes } from '@pnpm/config'
+import { type Config, getOptionsFromRootManifest, types as allTypes } from '@pnpm/config'
 import { PnpmError } from '@pnpm/error'
 import { arrayOfWorkspacePackagesToMap, findWorkspacePackages } from '@pnpm/workspace.find-packages'
 import { getAllDependenciesFromManifest } from '@pnpm/manifest-utils'
@@ -15,7 +15,6 @@ import { mutateModulesInSingleProject } from '@pnpm/core'
 import pick from 'ramda/src/pick'
 import without from 'ramda/src/without'
 import renderHelp from 'render-help'
-import { getOptionsFromRootManifest } from './getOptionsFromRootManifest'
 import { getSaveType } from './getSaveType'
 import { recursive } from './recursive'

@@ -143,6 +142,7 @@ export async function handler (
  | 'rawLocalConfig'
  | 'registries'
  | 'rootProjectManifest'
+  | 'rootProjectManifestDir'
  | 'saveDev'
  | 'saveOptional'
  | 'saveProd'
@@ -172,7 +172,7 @@ export async function handler (
  }
  const store = await createOrConnectStoreController(opts)
  const removeOpts = Object.assign(opts, {
-    ...getOptionsFromRootManifest(opts.rootProjectManifest ?? {}),
+    ...getOptionsFromRootManifest(opts.rootProjectManifestDir!, opts.rootProjectManifest ?? {}),
    storeController: store.ctrl,
    storeDir: store.dir,
    include,
--- a/pkg-manager/plugin-commands-installation/src/unlink.ts
+++ b/pkg-manager/plugin-commands-installation/src/unlink.ts
@@ -1,10 +1,9 @@
 import { docsUrl, readProjectManifestOnly } from '@pnpm/cli-utils'
 import { UNIVERSAL_OPTIONS } from '@pnpm/common-cli-options-help'
-import { type Config } from '@pnpm/config'
+import { type Config, getOptionsFromRootManifest } from '@pnpm/config'
 import { createOrConnectStoreController, type CreateStoreControllerOptions } from '@pnpm/store-connection-manager'
 import { mutateModulesInSingleProject } from '@pnpm/core'
 import renderHelp from 'render-help'
-import { getOptionsFromRootManifest } from './getOptionsFromRootManifest'
 import { cliOptionsTypes, rcOptionsTypes } from './install'
 import { recursive } from './recursive'

@@ -55,6 +54,7 @@ export async function handler (
  | 'rawLocalConfig'
  | 'registries'
  | 'rootProjectManifest'
+  | 'rootProjectManifestDir'
  | 'pnpmfile'
  | 'workspaceDir'
  > & {
@@ -73,7 +73,7 @@ export async function handler (
  }
  const store = await createOrConnectStoreController(opts)
  const unlinkOpts = Object.assign(opts, {
-    ...getOptionsFromRootManifest(opts.rootProjectManifest ?? {}),
+    ...getOptionsFromRootManifest(opts.rootProjectManifestDir!, opts.rootProjectManifest ?? {}),
    globalBin: opts.bin,
    storeController: store.ctrl,
    storeDir: store.dir,
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -109,8 +109,8 @@ importers:
        specifier: 1.0.0
        version: 1.0.0
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/tsconfig':
        specifier: workspace:*
        version: link:__utils__/tsconfig
@@ -224,8 +224,8 @@ importers:
        specifier: workspace:*
        version: link:../../pkg-manager/modules-yaml
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/types':
        specifier: workspace:*
        version: link:../../packages/types
@@ -261,8 +261,8 @@ importers:
  __utils__/assert-store:
    dependencies:
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/store.cafs':
        specifier: workspace:*
        version: link:../../store/cafs
@@ -1159,8 +1159,8 @@ importers:
  exec/plugin-commands-rebuild:
    dependencies:
      '@pnpm/builder.policy':
-        specifier: 1.0.0
-        version: 1.0.0
+        specifier: 1.1.0
+        version: 1.1.0
      '@pnpm/calc-dep-state':
        specifier: workspace:*
        version: link:../../packages/calc-dep-state
@@ -1274,8 +1274,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/test-fixtures':
        specifier: workspace:*
        version: link:../../__utils__/test-fixtures
@@ -1389,8 +1389,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@types/is-windows':
        specifier: ^1.0.0
        version: 1.0.0
@@ -2802,8 +2802,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/test-fixtures':
        specifier: workspace:*
        version: link:../../__utils__/test-fixtures
@@ -2869,8 +2869,8 @@ importers:
        specifier: workspace:*
        version: link:../../exec/build-modules
      '@pnpm/builder.policy':
-        specifier: 1.0.0
-        version: 1.0.0
+        specifier: 1.1.0
+        version: 1.1.0
      '@pnpm/calc-dep-state':
        specifier: workspace:*
        version: link:../../packages/calc-dep-state
@@ -3062,8 +3062,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/store-path':
        specifier: workspace:*
        version: link:../../store/store-path
@@ -3219,6 +3219,9 @@ importers:
      '@pnpm/build-modules':
        specifier: workspace:*
        version: link:../../exec/build-modules
+      '@pnpm/builder.policy':
+        specifier: 1.1.0
+        version: 1.1.0
      '@pnpm/calc-dep-state':
        specifier: workspace:*
        version: link:../../packages/calc-dep-state
@@ -3335,8 +3338,8 @@ importers:
        specifier: workspace:*
        version: link:../read-projects-context
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/store-path':
        specifier: workspace:*
        version: link:../../store/store-path
@@ -3689,8 +3692,8 @@ importers:
        specifier: workspace:*
        version: 'link:'
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/test-fixtures':
        specifier: workspace:*
        version: link:../../__utils__/test-fixtures
@@ -3882,8 +3885,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/test-fixtures':
        specifier: workspace:*
        version: link:../../__utils__/test-fixtures
@@ -4430,8 +4433,8 @@ importers:
        specifier: workspace:*
        version: link:../pkg-manifest/read-project-manifest
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/run-npm':
        specifier: workspace:*
        version: link:../exec/run-npm
@@ -4684,8 +4687,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)

  releasing/plugin-commands-publishing:
    dependencies:
@@ -4781,8 +4784,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@types/cross-spawn':
        specifier: ^6.0.3
        version: 6.0.3
@@ -5329,8 +5332,8 @@ importers:
        specifier: workspace:*
        version: link:../../pkg-manifest/read-package-json
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/test-fixtures':
        specifier: workspace:*
        version: link:../../__utils__/test-fixtures
@@ -5393,8 +5396,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@types/ramda':
        specifier: 0.28.20
        version: 0.28.20
@@ -5487,8 +5490,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@pnpm/test-fixtures':
        specifier: workspace:*
        version: link:../../__utils__/test-fixtures
@@ -5816,8 +5819,8 @@ importers:
        specifier: workspace:*
        version: link:../../__utils__/prepare
      '@pnpm/registry-mock':
-        specifier: 3.11.0
-        version: 3.11.0(typanion@3.14.0)
+        specifier: 3.13.0
+        version: 3.13.0(typanion@3.14.0)
      '@types/archy':
        specifier: 0.0.32
        version: 0.0.32
@@ -7698,8 +7701,8 @@ packages:
    dev: false
    optional: true

-  /@pnpm/builder.policy@1.0.0:
-    resolution: {integrity: sha512-0BhTu6nZ5DzIjJzuTJWOVbd1cN+0wu8k1aXXSawT+/i9Biq/3vuzqnxiTSt5e7IStZ01n59GTMvCoZ/VRAYQiA==}
+  /@pnpm/builder.policy@1.1.0:
+    resolution: {integrity: sha512-G+u6np4QywMBd3k2GXK1fQRk0ADQVV67o51TXkm9JUhKIdID3K/k5mOV/R1f+eZHfnHO26wFZSfR38lYBiSH+A==}
    engines: {node: '>=12.22.0'}
    dev: false

@@ -8181,8 +8184,8 @@ packages:
      strip-bom: 4.0.0
    dev: true

-  /@pnpm/registry-mock@3.11.0(typanion@3.14.0):
-    resolution: {integrity: sha512-Uc2h/h97YepX0Depm6/nOIUzjLz1Ny7xoL91GYcRRq/pbWJamCCGFSmZTHiBc3oX1WzremOqe4vvqE3uTkWZQg==}
+  /@pnpm/registry-mock@3.13.0(typanion@3.14.0):
+    resolution: {integrity: sha512-Tf5Ml98HpJWpzSnkSAYndlsWYSPNEonjE/rujvzeRB8j6NRnP6v5rrTK7m4nrXSDDPo/ADwyVXcp+7uQiCItrg==}
    engines: {node: '>=10.13'}
    hasBin: true
    dependencies:
@@ -8403,6 +8406,7 @@ packages:
  /@tootallnate/once@2.0.0:
    resolution: {integrity: sha512-XCuKFP5PS55gnMVu3dty8KPatLqUoy/ZYzDzAGCQ8JNFCkLXzmI7vNHCR+XpbZaMWQK/vQubr7PkYq8g470J/A==}
    engines: {node: '>= 10'}
+    requiresBuild: true
    dev: false

  /@tsconfig/node10@1.0.9:
@@ -9272,6 +9276,7 @@ packages:
  /agentkeepalive@4.5.0:
    resolution: {integrity: sha512-5GG/5IbQQpC9FpkRGsSvZI5QYeSCzlJHdpBQntCsuTOxhKD8lqKhrleg2Yi7yvMIf82Ycmmqln9U8V9qwEiJew==}
    engines: {node: '>= 8.0.0'}
+    requiresBuild: true
    dependencies:
      humanize-ms: 1.2.1
    dev: false
@@ -9443,6 +9448,7 @@ packages:

  /aproba@2.0.0:
    resolution: {integrity: sha512-lYe4Gx7QT+MKGbDsA+Z+he/Wtef0BiwDOlK/XkBrdfsh9J/jPPXbX0tE9x9cl27Tmu5gg3QUbUrQYa/y+KOHPQ==}
+    requiresBuild: true
    dev: false

  /archy@1.0.0:
@@ -9459,6 +9465,7 @@ packages:
  /are-we-there-yet@3.0.1:
    resolution: {integrity: sha512-QZW4EDmGwlYur0Yyf/b2uGucHQMa8aFUP7eu9ddR73vvhFyt4V0Vl3QHPcTNJ8l6qYOBdxgXdnBXQrHilfRQBg==}
    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+    requiresBuild: true
    dependencies:
      delegates: 1.0.0
      readable-stream: 3.6.2
@@ -10171,6 +10178,7 @@ packages:
  /color-support@1.1.3:
    resolution: {integrity: sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==}
    hasBin: true
+    requiresBuild: true
    dev: false

  /colors@0.6.2:
@@ -10273,6 +10281,7 @@ packages:

  /console-control-strings@1.1.0:
    resolution: {integrity: sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==}
+    requiresBuild: true

  /content-disposition@0.5.4:
    resolution: {integrity: sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==}
@@ -10632,6 +10641,7 @@ packages:

  /delegates@1.0.0:
    resolution: {integrity: sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==}
+    requiresBuild: true

  /depd@1.1.2:
    resolution: {integrity: sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==}
@@ -10816,6 +10826,7 @@ packages:
  /env-paths@2.2.1:
    resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==}
    engines: {node: '>=6'}
+    requiresBuild: true
    dev: false

  /envinfo@7.8.1:
@@ -10825,6 +10836,7 @@ packages:

  /err-code@2.0.3:
    resolution: {integrity: sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==}
+    requiresBuild: true
    dev: false

  /error-ex@1.3.2:
@@ -11736,6 +11748,7 @@ packages:
  /gauge@4.0.4:
    resolution: {integrity: sha512-f9m+BEN5jkg6a0fZjleidjN51VE1X+mPFQ2DJ0uv1V39oCLCbsGe6yjbBnp7eK7z/+GAon99a3nHuqbuuthyPg==}
    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+    requiresBuild: true
    dependencies:
      aproba: 2.0.0
      color-support: 1.1.3
@@ -12065,6 +12078,7 @@ packages:

  /has-unicode@2.0.1:
    resolution: {integrity: sha512-8Rf9Y83NBReMnx0gFzA8JImQACstCYWUplepDa9xprwwtmgEZUF0h/i5xSA625zB/I37EtrswSST6OXxwaaIJQ==}
+    requiresBuild: true

  /has@1.0.4:
    resolution: {integrity: sha512-qdSAmqLF6209RFj4VVItywPMbm3vWylknmB3nvNiUIs72xAimcM8nVYxYr7ncvZq5qzk9MKIZR8ijqD/1QuYjQ==}
@@ -12121,6 +12135,7 @@ packages:
  /http-proxy-agent@5.0.0:
    resolution: {integrity: sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==}
    engines: {node: '>= 6'}
+    requiresBuild: true
    dependencies:
      '@tootallnate/once': 2.0.0
      agent-base: 6.0.2
@@ -12166,6 +12181,7 @@ packages:

  /humanize-ms@1.2.1:
    resolution: {integrity: sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==}
+    requiresBuild: true
    dependencies:
      ms: 2.1.3
    dev: false
@@ -12314,6 +12330,7 @@ packages:

  /ip@2.0.0:
    resolution: {integrity: sha512-WKa+XuLG1A1R0UWhl2+1XQSi+fZWMsYKffMZTTYsiZaUD8k2yDAj5atimTUD2TZkyCkNEeYE5NhFZmupOGtjYQ==}
+    requiresBuild: true
    dev: false

  /ipaddr.js@1.9.1:
@@ -12459,6 +12476,7 @@ packages:

  /is-lambda@1.0.1:
    resolution: {integrity: sha512-z7CMFGNrENq5iFB9Bqo64Xk6Y9sg+epq1myIcdHaGnbMTYOxvzsEtdYqQUylB7LxfkvgrrjP32T6Ywciio9UIQ==}
+    requiresBuild: true
    dev: false

  /is-negated-glob@1.0.0:
@@ -13470,6 +13488,7 @@ packages:
  /lru-cache@7.18.3:
    resolution: {integrity: sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA==}
    engines: {node: '>=12'}
+    requiresBuild: true
    dev: false

  /lru-cache@9.1.2:
@@ -13825,6 +13844,7 @@ packages:
  /minipass-collect@1.0.2:
    resolution: {integrity: sha512-6T6lH0H8OG9kITm/Jm6tdooIbogG9e0tLgpY6mphXSm/A9u8Nq1ryBG+Qspiub9LjWlBPsPS3tWQ/Botq4FdxA==}
    engines: {node: '>= 8'}
+    requiresBuild: true
    dependencies:
      minipass: 3.3.6
    dev: false
@@ -13856,6 +13876,7 @@ packages:
  /minipass-flush@1.0.5:
    resolution: {integrity: sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==}
    engines: {node: '>= 8'}
+    requiresBuild: true
    dependencies:
      minipass: 3.3.6
    dev: false
@@ -13863,6 +13884,7 @@ packages:
  /minipass-pipeline@1.2.4:
    resolution: {integrity: sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==}
    engines: {node: '>=8'}
+    requiresBuild: true
    dependencies:
      minipass: 3.3.6
    dev: false
@@ -13870,6 +13892,7 @@ packages:
  /minipass-sized@1.0.3:
    resolution: {integrity: sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==}
    engines: {node: '>=8'}
+    requiresBuild: true
    dependencies:
      minipass: 3.3.6
    dev: false
@@ -14258,6 +14281,7 @@ packages:
  /npmlog@6.0.2:
    resolution: {integrity: sha512-/vBvz5Jfr9dT/aFWd0FIRf+T/Q2WBsLENygUaFUqstqsycmZAP/t5BvFJTK0viFmSUxiUKTUplWy5vt+rvKIxg==}
    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
+    requiresBuild: true
    dependencies:
      are-we-there-yet: 3.0.1
      console-control-strings: 1.1.0
@@ -14845,6 +14869,7 @@ packages:
  /promise-retry@2.0.1:
    resolution: {integrity: sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==}
    engines: {node: '>=10'}
+    requiresBuild: true
    dependencies:
      err-code: 2.0.3
      retry: 0.12.0
@@ -15354,6 +15379,7 @@ packages:
  /retry@0.12.0:
    resolution: {integrity: sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==}
    engines: {node: '>= 4'}
+    requiresBuild: true
    dev: false

  /retry@0.13.1:
@@ -15551,6 +15577,7 @@ packages:

  /set-blocking@2.0.0:
    resolution: {integrity: sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==}
+    requiresBuild: true

  /set-function-name@2.0.1:
    resolution: {integrity: sha512-tMNCiqYVkXIZgc2Hnoy2IvC/f8ezc5koaRFkCjrpWzGpCd3qbZXPzVy9MAZzK1ch/X0jvSkojys3oqJN0qCmdA==}
@@ -15687,6 +15714,7 @@ packages:
  /smart-buffer@4.2.0:
    resolution: {integrity: sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==}
    engines: {node: '>= 6.0.0', npm: '>= 3.0.0'}
+    requiresBuild: true
    dev: false

  /smartwrap@2.0.2:
@@ -15740,6 +15768,7 @@ packages:
  /socks@2.7.1:
    resolution: {integrity: sha512-7maUZy1N7uo6+WVEX6psASxtNlKaNVMlGQKkG/63nEDdLOWNbiUMoLK7X4uYoLhQstau72mLgfEWcXcwsaHbYQ==}
    engines: {node: '>= 10.13.0', npm: '>= 3.0.0'}
+    requiresBuild: true
    dependencies:
      ip: 2.0.0
      smart-buffer: 4.2.0
@@ -15806,7 +15835,7 @@ packages:
    resolution: {integrity: sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==}
    dependencies:
      spdx-expression-parse: 3.0.1
-      spdx-license-ids: 3.0.15
+      spdx-license-ids: 3.0.16

  /spdx-exceptions@2.3.0:
    resolution: {integrity: sha512-/tTrYOC7PPI1nUAgx34hUpqXuyJG+DTHJTnIULG4rDygi4xu/tfgmq1e1cIRwRzwZgo4NLySi+ricLkZkw4i5A==}
@@ -15815,10 +15844,10 @@ packages:
    resolution: {integrity: sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==}
    dependencies:
      spdx-exceptions: 2.3.0
-      spdx-license-ids: 3.0.15
+      spdx-license-ids: 3.0.16

-  /spdx-license-ids@3.0.15:
-    resolution: {integrity: sha512-lpT8hSQp9jAKp9mhtBU4Xjon8LPGBvLIuBiSVhMEtmLecTh2mO0tlqrAMp47tBXzMr13NJMQ2lf7RpQGLJ3HsQ==}
+  /spdx-license-ids@3.0.16:
+    resolution: {integrity: sha512-eWN+LnM3GR6gPu35WxNgbGl8rmY1AEmoMDvL/QD6zYmPWgywxWqJWNdLGT+ke8dKNWrcYgYjPpG5gbTfghP8rw==}

  /split-cmd@1.0.1:
    resolution: {integrity: sha512-HnyUFgtv7yNcGKK1+tO1O2eyXwEVnXqQzjshvroHsCu4M9fxS8lJ3bpW9XfD8YG0SdxW6hXNHdT/VFAxtNY1yw==}
@@ -15916,6 +15945,7 @@ packages:
  /string-width@1.0.2:
    resolution: {integrity: sha512-0XsVpQLnVCXHJfyEs8tC0zpTVIr5PKKsQtkT29IwupnPTjtPmQ3xT/4yCREF9hYkV/3M3kzcUTSAZT6a6h81tw==}
    engines: {node: '>=0.10.0'}
+    requiresBuild: true
    dependencies:
      code-point-at: 1.1.0
      is-fullwidth-code-point: 1.0.0
@@ -17036,6 +17066,7 @@ packages:

  /wide-align@1.1.5:
    resolution: {integrity: sha512-eDMORYaPNZ4sQIuuYPDHdQvf4gyCF9rEEV/yPxGfwPkRodwEgiMUUXTx/dex+Me0wxx53S+NgUHaP7y3MGlDmg==}
+    requiresBuild: true
    dependencies:
      string-width: 4.2.3

--- a/pnpm/package.json
+++ b/pnpm/package.json
@@ -62,7 +62,7 @@
    "@pnpm/prepare": "workspace:*",
    "@pnpm/read-package-json": "workspace:*",
    "@pnpm/read-project-manifest": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/run-npm": "workspace:*",
    "@pnpm/tabtab": "^0.1.2",
    "@pnpm/test-fixtures": "workspace:*",
--- a/pnpm/test/install/lifecycleScripts.ts
+++ b/pnpm/test/install/lifecycleScripts.ts
@@ -1,6 +1,8 @@
+import fs from 'fs'
 import path from 'path'
 import { prepare } from '@pnpm/prepare'
 import { type PackageManifest } from '@pnpm/types'
+import rimraf from '@zkochan/rimraf'
 import PATH from 'path-name'
 import loadJsonFile from 'load-json-file'
 import { execPnpmSync } from '../utils'
@@ -133,3 +135,30 @@ test('node-gyp is in the PATH', async () => {

  expect(result.status).toBe(0)
 })
+
+test('selectively allow scripts in some dependencies by onlyBuiltDependenciesFile', async () => {
+  prepare({
+    pnpm: {
+      onlyBuiltDependenciesFile: 'node_modules/@pnpm.e2e/build-allow-list/list.json',
+    },
+  })
+  execPnpmSync(['add', '@pnpm.e2e/build-allow-list', '@pnpm.e2e/pre-and-postinstall-scripts-example@1.0.0', '@pnpm.e2e/install-script-example'])
+
+  expect(fs.existsSync('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-preinstall.js')).toBeFalsy()
+  expect(fs.existsSync('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-postinstall.js')).toBeFalsy()
+  expect(fs.existsSync('node_modules/@pnpm.e2e/install-script-example/generated-by-install.js')).toBeTruthy()
+
+  await rimraf('node_modules')
+
+  execPnpmSync(['install', '--frozen-lockfile'])
+
+  expect(fs.existsSync('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-preinstall.js')).toBeFalsy()
+  expect(fs.existsSync('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-postinstall.js')).toBeFalsy()
+  expect(fs.existsSync('node_modules/@pnpm.e2e/install-script-example/generated-by-install.js')).toBeTruthy()
+
+  execPnpmSync(['rebuild'])
+
+  expect(fs.existsSync('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-preinstall.js')).toBeFalsy()
+  expect(fs.existsSync('node_modules/@pnpm.e2e/pre-and-postinstall-scripts-example/generated-by-postinstall.js')).toBeFalsy()
+  expect(fs.existsSync('node_modules/@pnpm.e2e/install-script-example/generated-by-install.js')).toBeTruthy()
+})
--- a/releasing/plugin-commands-deploy/package.json
+++ b/releasing/plugin-commands-deploy/package.json
@@ -39,7 +39,7 @@
    "@pnpm/lockfile-types": "workspace:*",
    "@pnpm/plugin-commands-deploy": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0"
+    "@pnpm/registry-mock": "3.13.0"
  },
  "dependencies": {
    "@pnpm/cli-utils": "workspace:*",
--- a/releasing/plugin-commands-publishing/package.json
+++ b/releasing/plugin-commands-publishing/package.json
@@ -35,7 +35,7 @@
    "@pnpm/filter-workspace-packages": "workspace:*",
    "@pnpm/plugin-commands-publishing": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@types/cross-spawn": "^6.0.3",
    "@types/is-windows": "^1.0.0",
    "@types/npm-packlist": "^3.0.0",
--- a/reviewing/plugin-commands-licenses/package.json
+++ b/reviewing/plugin-commands-licenses/package.json
@@ -36,7 +36,7 @@
    "@pnpm/plugin-commands-licenses": "workspace:*",
    "@pnpm/prepare": "workspace:*",
    "@pnpm/read-package-json": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/test-fixtures": "workspace:*",
    "@types/ramda": "0.28.20",
    "@types/wrap-ansi": "^8.0.1",
--- a/reviewing/plugin-commands-listing/package.json
+++ b/reviewing/plugin-commands-listing/package.json
@@ -34,7 +34,7 @@
    "@pnpm/plugin-commands-installation": "workspace:*",
    "@pnpm/plugin-commands-listing": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@types/ramda": "0.28.20",
    "execa": "npm:safe-execa@0.1.2",
    "strip-ansi": "^6.0.1",
--- a/reviewing/plugin-commands-outdated/package.json
+++ b/reviewing/plugin-commands-outdated/package.json
@@ -35,7 +35,7 @@
    "@pnpm/plugin-commands-installation": "workspace:*",
    "@pnpm/plugin-commands-outdated": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@pnpm/test-fixtures": "workspace:*",
    "@types/ramda": "0.28.20",
    "@types/wrap-ansi": "^8.0.1",
--- a/store/plugin-commands-store/package.json
+++ b/store/plugin-commands-store/package.json
@@ -34,7 +34,7 @@
    "@pnpm/lockfile-file": "workspace:*",
    "@pnpm/plugin-commands-store": "workspace:*",
    "@pnpm/prepare": "workspace:*",
-    "@pnpm/registry-mock": "3.11.0",
+    "@pnpm/registry-mock": "3.13.0",
    "@types/archy": "0.0.32",
    "@types/ramda": "0.28.20",
    "@types/ssri": "^7.1.1",