# What changed in @lavamoat/allow-scripts

> 6 changes in @lavamoat/allow-scripts 4 to 5 from its official release notes, upgrade guides and advisories: 3 breaking, 1 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/@lavamoat/allow-scripts/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## @lavamoat/allow-scripts 5

### Breaking changes

- An allowed version no longer matches lower versions. (5.0.0) — [release notes](https://github.com/LavaMoat/LavaMoat/releases/tag/allow-scripts-v5.0.0)
- Install scripts default to pinned versions, and migration requires an action. (5.0.0) — [release notes](https://github.com/LavaMoat/LavaMoat/releases/tag/allow-scripts-v5.0.0)

### New APIs and options

- Adds a check command to warn in CI when an update is needed. (5.1.0) — [release notes](https://github.com/LavaMoat/LavaMoat/releases/tag/allow-scripts-v5.1.0)

### Fixes and other changes

- Fixes backward-compatibility issues with --skip-versions. (5.0.2) — [release notes](https://github.com/LavaMoat/LavaMoat/releases/tag/allow-scripts-v5.0.2)
- Fixed migration logic for v5. (5.0.1) — [release notes](https://github.com/LavaMoat/LavaMoat/releases/tag/allow-scripts-v5.0.1)

## @lavamoat/allow-scripts 4

### Breaking changes

- Node.js v18 is no longer supported. (4.0.0) — [release notes](https://github.com/LavaMoat/LavaMoat/releases/tag/allow-scripts-v4.0.0)