denoland/deno · error

Only npm packages are supported: {}

Error message

Only npm packages are supported: {}

What it means

The `allowScripts`/npmScripts dependency parser (`parse_npm_package_req`, used by script-approval tooling) only accepts npm packages. A specifier parsed as `PackageKind::Jsr` — i.e. carrying a `jsr:` scheme — is rejected because lifecycle scripts only exist for npm packages.

Source

Thrown at cli/tools/pm/approve_scripts.rs:328

    }
    AllowScriptsValueConfig::Limited(reqs) => {
      let allow: Vec<String> = reqs.iter().map(|req| req.to_string()).collect();
      if deny.is_empty() {
        json!(allow)
      } else {
        json!({ "allow": allow, "deny": deny })
      }
    }
  }
}

fn parse_npm_package_req(text: &str) -> Result<PackageReq, AnyError> {
  let req = match JsrDepPackageReq::from_str_loose(text) {
    Ok(JsrDepPackageReq {
      kind: PackageKind::Jsr,
      ..
    }) => {
      bail!("Only npm packages are supported: {}", text);
    }
    Ok(
      req @ JsrDepPackageReq {
        kind: PackageKind::Npm,
        ..
      },
    ) => req,
    Err(JsrDepPackageReqParseError::NotExpectedScheme(_))
      if !text.contains(':') =>
    {
      return parse_npm_package_req(&format!("npm:{text}"));
    }
    Err(e) => return Err(e.into()),
  };
  if req.req.version_req.tag().is_some() {
    bail!("Tags are not supported in the allowScripts field: {}", text);
  }
  Ok(req.req)

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Remove the `jsr:` entry from allowScripts — JSR packages cannot run install scripts so no approval is needed.
2. If the same-named npm package is intended, write it as `npm:package-name`.
3. Keep only npm: prefixed or bare npm names in these lists.

Example fix

// deno.json (before)
{
  "npmScripts": { "allow": ["jsr:@scope/pkg", "npm:esbuild"] }
}
// deno.json (after)
{
  "npmScripts": { "allow": ["npm:esbuild"] }
}

const cfg = JSON.parse(readFileSync("deno.json", "utf8"));
const entries = [...(cfg.npmScripts?.allow ?? []), ...(cfg.npmScripts?.deny ?? [])];
const bad = entries.filter((s) => s.startsWith("jsr:"));
if (bad.length) {
  console.error(`jsr: entries are not allowed in npmScripts: ${bad.join(", ")}`);
  process.exit(1);
}

const isNpmScriptsEntry = (s: string): boolean =>
  !s.includes(":") || s.startsWith("npm:");

When it happens

Trigger: An entry like `"jsr:@scope/pkg"` in the deno.json `npmScripts.allow`/`deny` lists, or passing a jsr: specifier to `deno approve-scripts` style input. Bare names without `:` get auto-prefixed `npm:` and succeed; explicit `jsr:` fails.

Common situations: Pasting JSR dependencies from `imports` into the npmScripts section;. Assuming all dependency entries share one format; migration from a config where jsr entries were valid elsewhere.

Related errors

• Tags are not supported in the allowScripts field: {}
• Unexpected package json dependency string: "{string_value}"
• {entry_text} is missing a prefix. Did you mean `{}`?
• unable to find npm package in workspace
• missing version in package.json of npm package

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/20d1a34648771e5c. Report an issue: GitHub.