fix(NOJIRA-1234): harden yarn configuration

[tf-seti]

Harden yarn configuration

This PR hardens yarn configuration against recent supply chain attacks
(shai hulud,
shai hulud 2,
litellm,
axios).

Changes

.yarnrc security settings:

• ignore-scripts true — blocks all postinstall script execution (RATs, cryptominers, credential exfiltration)
• save-exact true — forces exact version pins on yarn add (no ^ prefix)

Dependabot cooldown (if npm ecosystem configured):

• 7-day cooldown for all version updates (major, minor, patch)
• Delays automated upgrade PRs, reducing exposure to recently published malicious versions

What you need to know

• ignore-scripts applies to both yarn install and yarn add — postinstall scripts will not run in either case.
• If your project needs postinstall scripts (e.g., husky, esbuild native binaries), run them explicitly:

  yarn rebuild esbuild    # rebuild native bindings
  npx husky install       # set up git hooks

References

• shai hulud — 180 npm packages hit
• shai hulud 2 — Zapier, ENS domains
• litellm PyPI supply chain attack
• axios npm compromise
• Dependabot cooldown docs

---

Automated by Application Security · supply-chain-hardening batch change

Created by Sourcegraph batch change david.salvador/harden-yarn-config.

[typeform-ops-gha]

[BOT] Preview available with hash 901f8874433164c43f265eaa0e5f8d29384e9c7c here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud