denoland/deno · error

Tags are not supported in the allowScripts field: {}

Error message

Tags are not supported in the allowScripts field: {}

What it means

After parsing an allowScripts entry, the code checks `req.req.version_req.tag()` and rejects dist-tags. `latest`, `next`, `canary` etc. are mutable pointers, so an allow-rule pinned to a tag would silently change meaning when the registry moves the tag.

Source

Thrown at cli/tools/pm/approve_scripts.rs:344

      ..
    }) => {
      bail!("Only npm packages are supported: {}", text);
    }
    Ok(
      req @ JsrDepPackageReq {
        kind: PackageKind::Npm,
        ..
      },
    ) => req,
    Err(JsrDepPackageReqParseError::NotExpectedScheme(_))
      if !text.contains(':') =>
    {
      return parse_npm_package_req(&format!("npm:{text}"));
    }
    Err(e) => return Err(e.into()),
  };
  if req.req.version_req.tag().is_some() {
    bail!("Tags are not supported in the allowScripts field: {}", text);
  }
  Ok(req.req)
}

fn package_req_matches_nv(req: &PackageReq, nv: &PackageNv) -> bool {
  req.name == nv.name && req.version_req.matches(&nv.version)
}

fn render_candidate(
  candidate: &ScriptCandidate,
  is_selected: bool,
  is_checked: bool,
) -> Result<TextItem<'static>, AnyError> {
  let mut line = String::new();
  write!(
    &mut line,
    "{} {} {}",
    if is_selected {

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Replace the tag with a concrete version or range: `npm:esbuild@^0.25` or `npm:esbuild@0.25.0`.
2. Or omit the version entirely to match any version of that package.
3. Audit other entries for tags since the check applies per entry.

Example fix

// deno.json (before)
{
  "npmScripts": { "allow": ["npm:esbuild@latest"] }
}
// deno.json (after)
{
  "npmScripts": { "allow": ["npm:esbuild@^0.25.0"] }
}

const TAG = /@(latest|next|canary|beta|alpha|rc|dev)$/i;
const entries = [...(cfg.npmScripts?.allow ?? []), ...(cfg.npmScripts?.deny ?? [])];
const bad = entries.filter((s) => TAG.test(s));
if (bad.length) {
  console.error(`dist-tags not allowed in npmScripts: ${bad.join(", ")}`);
  process.exit(1);
}

const hasDistTag = (s: string): boolean =>
  /@[^@\s]+$/i.test(s) && !/\d/.test(s.split("@").pop() ?? "");

When it happens

Trigger: An allowScripts entry with a dist-tag version, e.g. `"npm:esbuild@latest"` or `"cowsay@next"`. Plain names, exact versions (`@1.2.3`) and ranges (`@^1`) are fine.

Common situations: Copying a dependency line from package.json that uses a tag;. Writing `@latest` out of habit from `npm install pkg@latest`.

Related errors

• Only npm packages are supported: {}
• Missing 'version' field in '{}'. Add a version like: {
• Invalid semver version '{}'. Please provide a valid semver v
• Unexpected package json dependency string: "{string_value}"
• {entry_text} is missing a prefix. Did you mean `{}`?

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/cd8f4203363a7a45. Report an issue: GitHub.