security: set npmMinimalAgeGate to 7d

[OffenseTeacher]

Summary

Sets npmMinimalAgeGate: 7d in .yarnrc.yml to prevent Yarn from installing npm packages published less than 7 days ago.

This is a defence against supply chain worm attacks (Shai-Hulud, Sept 2025 / Glassworm 2026) that inject malicious post-install scripts into newly published popular packages.

Part of org-wide security hardening across all Yarn Berry repos.

[datadog-maintainx]

⚠️ Warnings

🚦 1 Pipeline job failed

Build and Test | Build and Test     

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: c40bb35 | Docs | Give us feedback!}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c40bb35. Configure here.}

[cursor]

yarnPath points to missing file

High Severity

yarnPath now targets .yarn/releases/yarn-4.11.0.cjs, but that release file is not in the repository (only yarn-4.14.1.cjs is present). Any Yarn invocation that reads this config will fail before installs or tests can run.

 

^{Reviewed by Cursor Bugbot for commit c40bb35. Configure here.}

[cursor]

Removed local plugin breaks tests

Medium Severity

The root config no longer loads @yarnpkg/plugin-unused-resolutions, which this repository implements. Fixture installs under tests/ inherit this config and expect the plugin to error on unused resolutions; without it, test.js assertions no longer match real behavior.

 

^{Reviewed by Cursor Bugbot for commit c40bb35. Configure here.}