chore(security): disable install scripts by default in /web

[dev-hari-prasad]

Part of #10363

Following up on Dave's feedback, this drops the global enableScripts: true from web/.yarnrc.yml so we're back to Yarn's safe default of blocking install scripts.

To keep things building properly, ttf2woff2 and unrs-resolver are explicitly allowlisted via dependenciesMeta in web/package.json. The only other script in the tree (core-js) is just a funding banner, so that stays blocked.

I also narrowed down approvedGitRepositories to just pgadmin-org/react-data-grid while touching the config.

Tested locally with yarn install --immutable, the linter, and Jest tests all ran and passed without issues.

Pretty sure that covers all the packages that actually need build scripts, but if I missed any or if something else should be excluded, please point it out, happy to fix it.

Summary by CodeRabbit

• Chores
  • Updated build and package configuration to allow required dependencies to compile correctly.
  • Restricted approved Git repository access during package installation.
  • Disabled package installation scripts.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 8aa84e04-5707-450c-ac98-0a12795be2f6

📥 Commits

Reviewing files that changed from the base of the PR and between bd7cde5 and e744a6e.

⛔ Files ignored due to path filters (1)

• web/yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• web/.yarnrc.yml
• web/package.json

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

Walkthrough

The Yarn configuration now restricts approved Git repositories, removes explicit script enablement, and marks ttf2woff2 and unrs-resolver as built dependencies.

Changes

Yarn installation policy

Layer / File(s)	Summary
Configure Yarn installation behavior web/.yarnrc.yml, web/package.json	The Git repository allowlist now contains one repository. The enableScripts setting was removed. ttf2woff2 and unrs-resolver are marked as built dependencies.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: 🟡 Moderate · up to e744a

This change restricts Yarn Git access and disables install scripts by default, but the repository allowlist appears to contain an organization-name typo that can break dependency installation in fresh environments. Correct the allowlist before merging.

Suggested reviewers: asheshv, dpage

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary security change: disabling Yarn install scripts by default in /web.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}