From e854dea8ce9d015ce5a30a2a8cc9c13da958964b Mon Sep 17 00:00:00 2001
From: MickLesk <47820557+MickLesk@users.noreply.github.com>
Date: Wed, 2 Sep 2026 17:22:48 +0200
Subject: [PATCH] setup_nodejs: restore the npm allowScripts bypass lost in the
 migration

npm 11 added allowScripts: dependency install hooks are skipped unless the
package is covered, and npm still exits 0. Installing an app with native
addons therefore "succeeds" with nothing built.

ProxmoxVE#16280 added the guard to misc/tools.func on 2026-08-08. It did not
come along when setup_nodejs moved here, and this file had no occurrence of
allowScripts at all. The line is copied back verbatim.

Reported for n8n: update ran clean, printed "Updated successfully!", and left
the service dead with DriverPackageNotInstalledError, because sqlite3 fetches
its binding from the install hook that was skipped. 272 ct/ and install/
scripts call setup_nodejs, so every app with native addons was on this path.

Refs community-scripts/ProxmoxVE#16973
---
 lib/runtime.func | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/runtime.func b/lib/runtime.func
index 3a7f5ef..1409db6 100644
--- a/lib/runtime.func
+++ b/lib/runtime.func
@@ -1370,6 +1370,12 @@ setup_nodejs() {
     fi
   fi
 
+  # npm 11+ skips install hooks not covered by allowScripts and still exits 0,
+  # so apps with native addons install with nothing built.
+  if [[ "$(npm -v 2>/dev/null | cut -d. -f1)" -ge 11 ]]; then
+    $STD npm config set dangerously-allow-all-scripts true --location=global 2>/dev/null || true
+  fi
+
   # Set a safe default heap limit for Node.js builds if not explicitly provided.
   # Priority:
   #   1) NODE_OPTIONS (caller/user override)