{"record":{"id":"20d1a34648771e5c","repo":"denoland/deno","slug":"only-npm-packages-are-supported","errorCode":null,"errorMessage":"Only npm packages are supported: {}","messagePattern":"Only npm packages are supported: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/pm/approve_scripts.rs","lineNumber":328,"sourceCode":"    }\n    AllowScriptsValueConfig::Limited(reqs) => {\n      let allow: Vec<String> = reqs.iter().map(|req| req.to_string()).collect();\n      if deny.is_empty() {\n        json!(allow)\n      } else {\n        json!({ \"allow\": allow, \"deny\": deny })\n      }\n    }\n  }\n}\n\nfn parse_npm_package_req(text: &str) -> Result<PackageReq, AnyError> {\n  let req = match JsrDepPackageReq::from_str_loose(text) {\n    Ok(JsrDepPackageReq {\n      kind: PackageKind::Jsr,\n      ..\n    }) => {\n      bail!(\"Only npm packages are supported: {}\", text);\n    }\n    Ok(\n      req @ JsrDepPackageReq {\n        kind: PackageKind::Npm,\n        ..\n      },\n    ) => req,\n    Err(JsrDepPackageReqParseError::NotExpectedScheme(_))\n      if !text.contains(':') =>\n    {\n      return parse_npm_package_req(&format!(\"npm:{text}\"));\n    }\n    Err(e) => return Err(e.into()),\n  };\n  if req.req.version_req.tag().is_some() {\n    bail!(\"Tags are not supported in the allowScripts field: {}\", text);\n  }\n  Ok(req.req)","sourceCodeStart":310,"sourceCodeEnd":346,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/pm/approve_scripts.rs#L310-L346","documentation":"The `allowScripts`/npmScripts dependency parser (`parse_npm_package_req`, used by script-approval tooling) only accepts npm packages. A specifier parsed as `PackageKind::Jsr` — i.e. carrying a `jsr:` scheme — is rejected because lifecycle scripts only exist for npm packages.","triggerScenarios":"An entry like `\"jsr:@scope/pkg\"` in the deno.json `npmScripts.allow`/`deny` lists, or passing a jsr: specifier to `deno approve-scripts` style input. Bare names without `:` get auto-prefixed `npm:` and succeed; explicit `jsr:` fails.","commonSituations":"Pasting JSR dependencies from `imports` into the npmScripts section;. Assuming all dependency entries share one format; migration from a config where jsr entries were valid elsewhere.","solutions":["Remove the `jsr:` entry from allowScripts — JSR packages cannot run install scripts so no approval is needed.","If the same-named npm package is intended, write it as `npm:package-name`.","Keep only npm: prefixed or bare npm names in these lists."],"exampleFix":"// deno.json (before)\n{\n  \"npmScripts\": { \"allow\": [\"jsr:@scope/pkg\", \"npm:esbuild\"] }\n}\n// deno.json (after)\n{\n  \"npmScripts\": { \"allow\": [\"npm:esbuild\"] }\n}","handlingStrategy":"validation","validationCode":"const cfg = JSON.parse(readFileSync(\"deno.json\", \"utf8\"));\nconst entries = [...(cfg.npmScripts?.allow ?? []), ...(cfg.npmScripts?.deny ?? [])];\nconst bad = entries.filter((s) => s.startsWith(\"jsr:\"));\nif (bad.length) {\n  console.error(`jsr: entries are not allowed in npmScripts: ${bad.join(\", \")}`);\n  process.exit(1);\n}","typeGuard":"const isNpmScriptsEntry = (s: string): boolean =>\n  !s.includes(\":\") || s.startsWith(\"npm:\");","tryCatchPattern":null,"preventionTips":["Remember npmScripts/allowScripts only governs npm lifecycle scripts; JSR packages never run them.","Keep dependency registries straight: jsr: belongs in imports, npm: (or bare) in npmScripts."],"tags":["npm","scripts","config","jsr"],"backgroundTag":"wrong-registry-specified","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}