Mitigate supply chain attacks with npmMinimalAgeGate and Lavamoat

[jeffsmale90]

Description

Yarn 4.10.0 introduces the npmMinimalAgeGate setting that allows a package to specify the minimum age that a package must be before it is installed. It has been recommended that we set a value of 3 days to mitigate supply chain attacks such as the recent event that targeted developer environments via compromised npm publisher accounts.

https://medium.com/@roman_fedyskyi/yarn-4-10-adds-a-release-age-gate-for-safer-dependency-management-765c2d18149a

This PR updates the package manager to 4.10.0 and sets the value for npmMinimalAgeGate to 3 days (4320 minutes).

Yarn 4 also includes yarn org plugins by default, so it is no longer necessary to specify these.

This PR also introduced @lavamoat/allow-scripts and @lavamoat/preinstall-always-fail to ensure that no malicious lifecycle scripts are run.

📋 Checklist

Check off completed items:

• Code follows the project's coding standards
• Self-review completed
• Documentation updated (if needed)
• Tests added/updated
• Changelog updated (if needed)
• All CI checks pass

🔗 Related Issues

Link to related issues:
Closes #
Related to #

📚 Additional Notes

Any additional information, concerns, or context:

---

Note

Upgrades Yarn to 4.10.0, enforces a 3‑day package age gate, and adds LavaMoat allow-scripts/preinstall safeguards.

• Build/Tooling:
  • Yarn: Bump packageManager to yarn@4.10.0; configure npmMinimalAgeGate: 4320 in .yarnrc.yml.
  • Install script hardening:
    • Add @lavamoat/allow-scripts and @lavamoat/preinstall-always-fail to devDependencies.
    • Add lavamoat.allowScripts config in package.json (disables scripts for @lavamoat/preinstall-always-fail and keccak).
    • Remove obsolete allow-scripts npm script.
• Dependencies:
  • Update lockfile to reflect new tooling and LavaMoat packages.

^{Written by Cursor Bugbot for commit 586d593. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​lavamoat/​preinstall-always-fail@​2.1.1
	is-core-module@​2.15.1 ⏵ 2.16.1	+1		+1
	npm-install-checks@​6.3.0
	spdx-correct@​3.2.0
	@​lavamoat/​aa@​4.3.4
	validate-npm-package-license@​3.0.4
	resolve@​1.22.8 ⏵ 1.22.10			+1
	ini@​4.1.3
	bin-links@​4.0.4
	normalize-package-data@​6.0.2
	@​npmcli/​promise-spawn@​7.0.2
	npm-pick-manifest@​9.1.0
	@​npmcli/​git@​5.0.8
	@​npmcli/​run-script@​8.1.0
	@​npmcli/​package-json@​5.2.1
	npm-package-arg@​11.0.3
	type-fest@​4.41.0
	hosted-git-info@​7.0.2
	node-gyp@​10.3.1
	@​lavamoat/​allow-scripts@​3.4.0

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• node-gyp@10.3.1

View full report

[jeffsmale90]

@SocketSecurity ignore npm/node-gyp@10.3.1

Reviewed release history and socket security page. Well maintained and utilised package. One major version behind latest.