[DOCS] Missing mention of breaking change lifecycle script block in npm@12.0.0 release notes

[MikeMcC399]

Situation

The release notes for npm@12.0.0 and the CHANGELOG 12.0.0 entry contain no mention of the breaking change to block lifecycle scripts by default.

---

In npm@11.18.0, a default npm configuration results in the following warning when a dependency with a lifecycle script is installed. The lifecycle script is executed:

npm warn allow-scripts 1 package has install scripts not yet covered by allowScripts:

---

In npm@12.0.0 this changes to a block by default. The lifecycle script is not executed. This is a breaking change:

npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:

---

Suggestion

Add the breaking change for npm@12.0.0 to the release notes, corresponding to the warning:

npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:

[prayag0one4]

I'd like to work on this documentation update and can prepare a PR for it.

[MikeMcC399]

@prayag0one4

I'd like to work on this documentation update and can prepare a PR for it.

You need to have write access to the repo to change https://github.com/npm/cli/releases/tag/v12.0.0 so submitting a PR will not resolve the whole issue. I suggest that you should leave the resolution to a core maintainer of the repo.

[prayag0one4]

Thanks for the clarification.

Would it still be useful to keep the changelog update in the repository as a separate contribution, with the GitHub release notes being updated manually by a maintainer, or would you prefer to handle both changes together internally?

[MikeMcC399]

I was just the person who raised the original issue. I'm not a maintainer of the repo, so I can't answer on their behalf.

[prayag0one4]

Thanks for the clarification, @MikeMcC399! I'll wait for feedback from the npm maintainers on whether they'd prefer to handle both changes internally or keep the changelog update as a separate contribution.

[MikeMcC399]

For whoever writes any update, I would suggest describing the install-scripts sequence more completely.

In a project, npm install-scripts approve can only be used after npm install (or other related CLI commands that install dependencies) have been run. To actually run the enabled lifecycle scripts locally once they've been approved, npm rebuild can be conveniently executed.

[MikeMcC399]

@JamieMagee

Are you aware of this issue?