Upgrade to Yarn v4.10.3 and enable npmMinimalAgeGate for supply chain protection

[Ariiellus]

Motivation

In September alone, there have been multipe supply chain attacks targeting NPM packages.

To mitigate these risks, Yarn recently introduced in their [release 4.10.0] (https://github.com/yarnpkg/berry/releases/tag/%40yarnpkg%2Fcli%2F4.10.0) a time-based safeguard (npmMinimalAgeGate) to delay the installation of the latest published versions, giving security researchers time to detect and report malicious packages.

Proposal

Upgrade the project to Yarn v4.10.3 (latest stable version) and enable npmMinimalAgeGate. This adds a delay before installing freshly published packages, reducing the attack surface for developers.

Suggested configuration:

npmMinimalAgeGate: 2880 # 2 days

This ensures a safer default window for identifying malicious packages without disrupting normal development workflows.

Manual Testing

Steps to validate locally:

1. Upgrade Yarn:

yarn set version 4.10.3

This updates package.json, .yarnrc.yml and .yarn/releases/ files

2. Update manually packages/nextsjs/package.json to reference the new Yarn version.

3. Add the following to .yarnrc.yml:

npmMinimalAgeGate: 2880

4. Run yarn install

This change should not impact the current SE2 devflow and provides an additional security layer for developers.

[Ariiellus]

I just opened a PR #1184

[carletex]

Thanks for this @Ariiellus

Just letting you know that we are taking a look at #1184 internally. Will share our findings there.

gracias amigo!