security: set npmMinimalAgeGate to 7d

[OffenseTeacher]

Summary

Sets npmMinimalAgeGate: 7d in .yarnrc.yml to prevent Yarn from installing npm packages published less than 7 days ago.

This is a defence against supply chain worm attacks (Shai-Hulud, Sept 2025 / Glassworm 2026) that inject malicious post-install scripts into newly published popular packages.

Part of org-wide security hardening across all Yarn Berry repos.

[datadog-maintainx]

⚠️ Warnings

🚦 1 Pipeline job failed

Pull request | Test & Lint     

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 33e78b2 | Docs | Give us feedback!}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 33e78b2. Configure here.}

[cursor]

Age gate unsupported on Yarn

High Severity

This change adds npmMinimalAgeGate: 7d, but the project runs Yarn 3.6.4 via yarnPath and packageManager. That option is implemented in newer Berry releases (from 4.10 onward), not in the pinned 3.6.4 bundle, so installs are not blocked for packages younger than seven days and the intended supply-chain control does not run.

 

^{Reviewed by Cursor Bugbot for commit 33e78b2. Configure here.}