chore: Upgrade Yarn from 4.12.0 to 4.17.1

[tassoevan]

Proposed changes (including videos or screenshots)

Upgrades Yarn from 4.12.0 to 4.17.1, updating the pinned yarnPath, packageManager, engines.yarn and volta.yarn fields accordingly, plus regenerating yarn.lock (lockfile format bumped from v8 to v10).

Issue(s)

Steps to test or reproduce

• Run yarn install and confirm it succeeds using the new Yarn release.
• Run the usual lint/test suite to confirm nothing regressed from the lockfile refresh.

Further comments

Task: ARCH-2290

Summary by CodeRabbit

• Chores
  • Updated the project’s Yarn toolchain to version 4.17.1.
  • Enabled required package installation scripts and repository approvals.
  • Removed the minimum package age restriction for installations.

[dionisio-bot]

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

[tassoevan]

/jira ARCH-2200

[changeset-bot]

⚠️ No Changeset found

Latest commit: 03c368e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Walkthrough

The repository updates its Yarn toolchain from 4.12.0 to 4.17.1 across Yarn configuration and package metadata, and enables approved Git repositories, install scripts, and zero-day npm package age gating.

Changes

Yarn toolchain update

Layer / File(s)	Summary
Align Yarn configuration and version pins .yarnrc.yml, package.json	Yarn 4.17.1 is configured across repository settings and package metadata. Git repositories are allow-listed, install scripts are enabled, and the npm minimal age gate is set to 0. Node remains pinned to 22.22.3.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: type: chore

Suggested reviewers: ggazzo, rocketchat-github-ci

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely summarizes the main change: upgrading Yarn from 4.12.0 to 4.17.1.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.yarnrc.yml:
- Around line 1-2: Replace the wildcard value in approvedGitRepositories with
explicit HTTPS and SSH URL patterns covering only the trusted repositories or
organizations. Preserve the allowlist configuration while removing the
unrestricted "**" entry.
- Around line 12-16: Update the Yarn configuration to remove the global
enableScripts: true and npmMinimalAgeGate: 0 settings. Keep install scripts and
the release-age protection enabled by default, and express any required
package-specific exceptions through scoped dependenciesMeta entries with a
nonzero npmMinimalAgeGate.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 739ec3e7-eaaa-4e63-b408-68c429898c49

📥 Commits

Reviewing files that changed from the base of the PR and between 30623d9 and 03c368e.

⛔ Files ignored due to path filters (3)

• .yarn/releases/yarn-4.12.0.cjs is excluded by !**/.yarn/**
• .yarn/releases/yarn-4.17.1.cjs is excluded by !**/.yarn/**
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• .yarnrc.yml
• package.json

📜 Review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: 📦 Build Packages
• GitHub Check: cubic · AI code reviewer
• GitHub Check: Hacktron Security Check
• GitHub Check: CodeQL-Build
• GitHub Check: CodeQL-Build

🧰 Additional context used

🧠 Learnings (2)

📚 Learning: 2026-03-23T19:33:43.067Z

Learnt from: cardoso
Repo: RocketChat/Rocket.Chat PR: 39818
File: apps/meteor/client/hooks/usePruneWarningMessage.ts:45-56
Timestamp: 2026-03-23T19:33:43.067Z
Learning: In Rocket.Chat, cron expressions used for the retention policy (e.g., `RetentionPolicy_Advanced_Precision_Cron`) follow the `cron` npm package convention, which uses **0-indexed months** (0 = January, 11 = December) rather than POSIX-style 1–12. In `apps/meteor/client/hooks/usePruneWarningMessage.ts`, the local `sendAt` logic intentionally mirrors this behavior—do **not** adjust `date.getMonth()` with `+1` or similar changes, because it will break tests and introduce inconsistency with the backend.

Applied to files:

• .yarnrc.yml

📚 Learning: 2026-04-23T18:14:22.005Z

Learnt from: d-gubert
Repo: RocketChat/Rocket.Chat PR: 39857
File: apps/meteor/app/lib/server/lib/debug.js:87-91
Timestamp: 2026-04-23T18:14:22.005Z
Learning: In apps/meteor/app/lib/server/lib/debug.js, do not flag a missing try/finally around the `wrapMethods` timing calls (`end()` / `endHistogram()`) as a bug. These timer calls are intentionally placed after `await originalHandler.apply(this, originalArgs)` because method-handler errors are handled by the higher-level route-handler action wrapper in apps/meteor/app/api/server/ApiClass.ts (around lines 892-893), which converts thrown errors into proper response objects and preserves the intended execution flow.

Applied to files:

• .yarnrc.yml

🔇 Additional comments (1)

package.json (1)

206-213: LGTM!

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.66%. Comparing base (30623d9) to head (03c368e).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #41510      +/-   ##
===========================================
- Coverage    68.69%   68.66%   -0.04%     
===========================================
  Files         4134     4134              
  Lines       160417   160417              
  Branches     29312    29237      -75     
===========================================
- Hits        110205   110154      -51     
- Misses       45104    45146      +42     
- Partials      5108     5117       +9     

Flag	Coverage Δ
e2e	58.90% <ø> (+0.01%)	⬆️
e2e-api	45.34% <ø> (ø)
unit	70.66% <ø> (-0.05%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.