Build: Add 7d minimum release age gate to the repository's Yarn config

[ndelangen]

Closes #

What I did

Yarn can refuse to install package versions that were published very recently.
Recent npm supply-chain attacks have followed the same shape: an attacker publishes a malicious patch release over a widely used package, and it is caught and pulled within hours.
Anything that installs during that short window gets the payload; anything that waits does not.

Our own repository had no such rule configured, so an attack landing in that window could reach a contributor or CI machine through any dependency update.

This sets that window to 7 days for the repository.

The rule only applies when a dependency is added or updated.
Installing from the committed lockfile is unaffected, so day-to-day work and CI behave exactly as before.
The practical effect is that adding or bumping a dependency will not pick up a release younger than a week.

This matches the rule applied to generated sandboxes in #34852.

Recreated from #35756 as a standalone PR (not part of the stacked PR chain), because GitHub's stacked-PR merge path could not land the bottom PR while CircleCI triggering is disabled for containment.

Manual testing

1. Install from the committed lockfile. It should succeed unchanged, with no lockfile modifications.
2. Try adding a dependency whose only matching release is a few days old. It should be refused rather than installed.
3. Add or bump a dependency whose releases are older than a week. It should succeed normally.

Checklist for Contributors

Testing

The changes in this PR are covered in the following automated tests:

• stories
• unit tests
• integration tests
• end-to-end tests

Manual testing

Caution

This section is mandatory for all contributions. If you believe no manual test is necessary, please state so explicitly. Thanks!

1. Install from the committed lockfile. It should succeed unchanged, with no lockfile modifications.
2. Try adding a dependency whose only matching release is a few days old. It should be refused rather than installed.
3. Add or bump a dependency whose releases are older than a week. It should succeed normally.

Documentation

• Add or update documentation reflecting your changes
• If you are deprecating/removing a feature, make sure to update
  MIGRATION.MD

Checklist for Maintainers

• When this PR is ready for testing, make sure to add ci:normal, ci:merged or ci:daily GH label to it to run a specific set of sandboxes. The particular set of sandboxes can be found in code/lib/cli-storybook/src/sandbox-templates.ts

• Declare whether manual QA will be needed for this PR during the next release, through qa:needed or qa:skip

• Make sure this PR contains one of the labels below:

  Available labels

  • bug: Internal changes that fixes incorrect behavior.
  • maintenance: User-facing maintenance tasks.
  • dependencies: Upgrading (sometimes downgrading) dependencies.
  • build: Internal-facing build tooling & test updates. Will not show up in release changelog.
  • cleanup: Minor cleanup style change. Will not show up in release changelog.
  • documentation: Documentation only changes. Will not show up in release changelog.
  • feature request: Introducing a new feature.
  • BREAKING CHANGE: Changes that break compatibility in some way with current major version.
  • other: Changes that don't fit in the above categories.

🦋 Canary release

This PR does not have a canary release associated. You can request a canary release of this pull request by mentioning the @storybookjs/core team here.

core team members can create a canary release here or locally with gh workflow run --repo storybookjs/storybook publish.yml --field pr=<PR_NUMBER>

Made with Cursor

[Copilot]

Pull request overview

Adds a repository-wide Yarn safeguard (npmMinimalAgeGate) to reduce exposure to newly published npm packages (a common supply-chain attack window) by requiring package versions to be at least 7 days old before Yarn will select them during dependency adds/updates.

Changes:

• Configure Yarn’s npmMinimalAgeGate to 7 days (10080 minutes) at the repo level.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 470bb83c-5fa9-4153-8993-7556778772be

📥 Commits

Reviewing files that changed from the base of the PR and between c6b8914 and adf8092.

📒 Files selected for processing (1)

• .yarnrc.yml

---

Walkthrough

Changes

Yarn package policy

Layer / File(s)	Summary
Configure npm package age gate .yarnrc.yml	The Yarn configuration sets npmMinimalAgeGate to 10080.

Possibly related PRs

• storybookjs/storybook#35756: Adds the same npmMinimalAgeGate: 10080 setting to .yarnrc.yml.

---

_{Comment @coderabbitai help to get the list of available commands.}