[Bug] [AI] Add npm allowScripts allowlist to sync-server package.json - #8683

Summary

Add an npm allowScripts allowlist to @actual-app/sync-server for the three deps with native install scripts, so npm install -g @actual-app/sync-server no longer triggers warnings on npm 11.16+/v12.

Problem

Closes #8584

When a user runs npm install -g @actual-app/sync-server on npm 11.16+ (or v12), npm prints install-script warnings for bcrypt@6.0.0, better-sqlite3@12.11.1, and (since 26.8.0) argon2@0.44.0. The warnings are advisory on npm 11.16+ but become a hard error on npm v12, blocking the install for self-hosted users. The root repo already mitigated this for yarn developers via PR #7825's dependenciesMeta block, but the dependenciesMeta field is yarn-only and does not apply to npm consumers of the published @actual-app/sync-server package.

Solution

Add a sibling npm-native allowScripts allowlist to packages/sync-server/package.json with pinned entries for the three native-install deps. This is the npm equivalent of the root dependenciesMeta allowlist and the field that npm approve-scripts writes by default.

"allowScripts": {
  "bcrypt": "6.0.0",
  "better-sqlite3": "12.11.1",
  "argon2": "0.44.0"
}

Pinned (not semver range) so the field matches the npm v11.16+/v12 default and mirrors the strict-version precedent set by PR #7825. The field will need a one-line update the next time any of these deps are bumped.

Changes Made

• packages/sync-server/package.json: add the allowScripts block at the end of the file, after engines, with pinned entries for bcrypt@6.0.0, better-sqlite3@12.11.1, and argon2@0.44.0 (the three deps with native install scripts).
• upcoming-release-notes/sync-server-allow-scripts-allowlist.md: short Bugfix release note in the project format.

yarn.lock is unchanged — yarn 4.17.1 treats the allowScripts key as opaque JSON and does not regenerate the lockfile when an unknown top-level key is added to a package's package.json. The new key is preserved verbatim and will appear in the published npm artifact.

Testing

• No unit tests added. PR #7825 established the precedent of not adding a test for the equivalent root dependenciesMeta allowlist. The change is a 5-line additive JSON edit; there is no logic surface to test.
• Local validation performed:
  • python3 -c 'import json; json.load(open("packages/sync-server/package.json"))' → valid JSON
  • git diff yarn.lock → no changes (yarn treats allowScripts as opaque)
• Manual verification: the field shape matches the example given in the npm approve-scripts docs and the allow-scripts package README.

Checklist

• Valid JSON (verified with python3 -c 'import json; ...')
• yarn.lock unchanged
• Release note added in the project format
• No unrelated changes
• No code change — no console.log or debug code to remove
• Field placement mirrors PR Disable postinstall scripts except for an allowlist #7825's dependenciesMeta placement for reviewer consistency

AI Disclosure

This PR was prepared with AI assistance (Githena) under maintainer supervision. The implementation is a 5-line additive JSON edit based directly on the issue body and the precedent set by PR #7825. All decisions (field shape, placement, pinned entries, no-tests) were reviewed against the project's existing conventions before commit.

Bundle Stats