Add approvedGitRepositories to Yarn config (#310)

Author: Mrtenz

.yarnrc.yml

@@ -1,21 +1,20 @@
+# Allowlist for Git repositories that can be used as dependencies. We set it to
+# an empty array to disallow all Git dependencies, as we don't use any and they
+# can be a security risk.
+approvedGitRepositories: []
+
 compressionLevel: mixed
 
 enableGlobalCache: false
 
 enableScripts: false
 
-enableTelemetry: 0
+enableTelemetry: false
 
 logFilters:
   - code: YN0004
     level: discard
 
-nodeLinker: node-modules
-
-plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
-    spec: "https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js"
-
 # Configure the NPM minimal age gate to 3 days, meaning packages must be at
 # least 3 days old to be installed.
 npmMinimalAgeGate: 4320 # 3 days (in minutes)
@@ -26,3 +25,9 @@ npmPreapprovedPackages:
   - '@metamask/*'
   - '@metamask-previews/*'
   - '@lavamoat/*'
+
+nodeLinker: node-modules
+
+plugins:
+  - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
+    spec: "https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js"

package.json

@@ -84,7 +84,7 @@
   "engines": {
     "node": "^20 || ^22 || >=24"
   },
-  "packageManager": "yarn@4.10.3",
+  "packageManager": "yarn@4.14.1",
   "lavamoat": {
     "allowScripts": {
       "@lavamoat/preinstall-always-fail": false,

yarn.lock

@@ -2,7 +2,7 @@
 # Manual changes might be lost - proceed with caution!
 
 __metadata:
-  version: 8
+  version: 9
   cacheKey: 10
 
 "@aashutoshrathi/word-wrap@npm:^1.2.3":