.yarnrc.yml

compressionLevel: mixed

enableGlobalCache: false

enableScripts: false

enableTelemetry: false

logFilters:
  - code: YN0004
    level: discard

nodeLinker: node-modules

npmAuditIgnoreAdvisories:
  ### Advisories:

  # Issue: Regular Expression Denial of Service (ReDOS)
  # URL: https://github.com/advisories/GHSA-257v-vj4p-3w2h
  # color-string is listed as a dependency of 'color' which is brought in by
  # @metamask/jazzicon v2.0.0 but there is work done on that repository to
  # remove the color dependency. We should upgrade
  - 1089718

  # Issue: Issue: Babel has inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups
  # We are ignoring this on April 24, 2025 to unblock CI, we will follow with a proper fix or confirmation this does not affect our users
  - 1104001

  # Issue: `glob` vulnerability, already fixed in the version we're using (v10.5.0) but the
  # advisory range hasn't been updated yet.
  # URL: https://github.com/advisories/GHSA-5j98-mcp5-4vw2
  - 1109809

  # Issue: `body-parser` denial of service vulnerability
  # Seemingly only impacts v2.2.0, but we're on v1. The advisory range is overly wide.
  # The attack vector also does not apply to how we use the package.
  # URL: https://github.com/advisories/GHSA-wqch-xfxh-vrr4
  - 1110857

  ### Package Deprecations:

  # React-tippy brings in popper.js and react-tippy has not been updated in
  # three years.
  - 'popper.js (deprecation)'

  # Material UI dependencies are planned for removal
  - '@material-ui/core (deprecation)'
  - '@material-ui/styles (deprecation)'

  # Dependencies brought in by @truffle/decoder that are deprecated:
  - 'cids (deprecation)' # via @ensdomains/content-hash
  - 'multibase (deprecation)' # via cids
  - 'multicodec (deprecation)' # via cids

  # Currently in use for the network list drag and drop functionality.
  # Maintenance has stopped and the project will be archived in 2025.
  - 'react-beautiful-dnd (deprecation)'
  # New package name format for new versions: @ethereumjs/wallet.
  - 'ethereumjs-wallet (deprecation)'

plugins:
  - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
    spec: 'https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js'
  - path: .yarn/plugins/@yarnpkg/plugin-engines.cjs
    spec: 'https://raw.githubusercontent.com/devoto13/yarn-plugin-engines/main/bundles/%40yarnpkg/plugin-engines.js'

# Configure the NPM minimal age gate to 3 days, meaning packages must be at
# least 3 days old to be installed.
npmMinimalAgeGate: 4320 # 3 days (in minutes)

# Override the minimal age gate, allowing certain packages to be installed
# regardless of their publish age.
npmPreapprovedPackages:
  - '@metamask/*'
  - '@metamask-previews/*'
  - '@lavamoat/*'
  - 'lavamoat-core'
  - 'lavamoat-browserify'
  - 'lavamoat-tofu'
  - 'lavamoat-node'