Upgrade Yarn to 4.18.0 to fix TypeScript 7 install failure

[shakuzen]

Summary

Dependabot's daily attempt to bump typescript (6.0.3 → 7.0.2) has been failing since TypeScript 7 shipped, blocking that update entirely (see the failing Dependabot Updates run):

YN0001: typescript@patch:typescript@npm%3A7.0.2#optional!builtin<compat/typescript>:
ENOENT: no such file or directory, lstat '/node_modules/typescript/lib/_tsc.js'

Yarn's builtin compat/typescript patch assumes the legacy JS-compiler file layout (renaming lib/tsc.js → lib/_tsc.js), but TypeScript 7 ships a restructured native compiler package that no longer has those files, so applying the patch fails and the whole install aborts.

This is a known upstream bug (yarnpkg/berry#7191), fixed by yarnpkg/berry#7190 — released in Yarn 4.17.1 — which bounds the compat patch to TypeScript <7 and makes optional-patch failures non-fatal instead of aborting the install. This PR upgrades to 4.18.0 (latest), which also includes #7216, a related bin-precedence fix for Yarn's recommended TS 6/7 side-by-side setup.

Changes

• packageManager in package.json: yarn@4.13.0 → yarn@4.18.0
• .yarn/releases/: swapped yarn-4.13.0.cjs for yarn-4.18.0.cjs
• .yarnrc.yml:
  • approvedGitRepositories: [] — new supply-chain gate (Yarn 4.15+) for git:-protocol deps, which can run arbitrary code via pack scripts even with enableScripts: false. Set to the empty default since this repo has no git: dependencies.
  • enableScripts: false — this is actually Yarn's real default as of 4.14 (postinstall scripts off by default for supply-chain safety). Yarn's version-migration step tried to pin this to true to preserve pre-upgrade behavior, but that's unnecessarily broad.
• package.json: added a dependenciesMeta allowlist so only the packages that actually need their install scripts get them, instead of enabling scripts project-wide:

  "dependenciesMeta": {
    "@swc/core": { "built": true },
    "esbuild": { "built": true },
    "workerd": { "built": true }
  }

  These three ship native binaries this project's tooling depends on (bundler, the SWC compiler used by @docusaurus/faster, and the Cloudflare Workers runtime used by wrangler). core-js/core-js-pure were deliberately left off the list — their postinstall is just a sponsorship banner with no functional effect (and it self-skips on CI anyway).
• yarn.lock: lockfile format bump (v8 → v10), an updated builtin compat-patch hash for resolve (an incidental one-line cleanup bundled into the same upstream release that fixed the TypeScript issue), and the new dependenciesMeta recorded against the workspace entry.

Test plan

• yarn install --immutable (what CI's build.yml runs) passes clean
• yarn typecheck passes clean
• yarn docusaurus build succeeds with a from-scratch node_modules (verifies the enableScripts: false + allowlist combination doesn't silently break the build)
• yarn wrangler deploy --dry-run succeeds (confirms workerd's absence wouldn't matter for deploy either way, since this is an assets-only Workers site)
• Reproduced Dependabot's exact failing command — yarn install --mode=update-lockfile with typescript bumped to 7.0.2 — against the upgraded Yarn, and confirmed it now succeeds instead of throwing ENOENT
• All of the above was verified locally on Windows — waiting on this PR's own CI run (ubuntu-latest) as the real confirmation, since native-binary script behavior can differ by OS

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	wiki-japanfinance	3aa1c77	Aug 02 2026, 05:18 AM

[argos-ci]

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
default (Inspect)	👍 Approved by Tommy Ludwig	5 changed, 1 added	Aug 2, 2026, 5:19 AM