Plugin update installs npm deps but native modules never get built (better-sqlite3 broken after update)

Status Fixed / completed
Reported on v2.1.220
Maintainer reply None cached
Activity 1 comment · opened Aug 2, 2026 · closed Aug 29, 2026

Version: 2.1.220, Windows 11. Plugin: devguard (git marketplace source, depends on better-sqlite3).

After /plugin update devguard the new version's cache dir had node_modules and .package-lock.json in place (nice, this part used to be missing entirely, see #42931), but better-sqlite3 had no build/Release at all. So every hook in the new version died on require until I ran npm rebuild better-sqlite3 inside the cache dir myself.

Guessing the install runs with --ignore-scripts? Makes sense as a security default, but the result is that any plugin with a native dep installs silently broken. No warning anywhere, the plugin just doesn't work and the user has no idea why.

Either of these would be enough:

  • document it clearly (the docs already recommend the SessionStart npm-install pattern, but nothing says "your native deps will NOT be built")
  • or print a warning when the dep tree contains install scripts that got skipped

Repro: install any plugin depending on better-sqlite3 from a git marketplace, then check node_modules/better-sqlite3/build/Release/ in the cache dir.

View original on GitHub ↗

This issue has 1 comment on GitHub. Read the full discussion on GitHub ↗