Summary
The release asks for approval before running package build scripts and keeps unapproved packages in the ignored-build-scripts state. It also adds trust-policy cleanup, safer global package operations and improved workspace peer dependency handling.
Why it matters
The changes reduce silent installation risk while making dependency and build behaviour more predictable for JavaScript teams.
Related coverage
- GitHub Agentic Workflows adds shared JavaScript modules for workflow packages
- GitHub Agentic Workflows adds package-aware updates and safer model accounting
- Claude Code fixes long-session permission regressions in read-only Git commands