From e744a6eb2aeb4fffe72bc50b798b45bba2c7aee4 Mon Sep 17 00:00:00 2001
From: dev-hari-prasad <webdev.byhari@gmail.com>
Date: Mon, 7 Sep 2026 04:06:17 +0530
Subject: [PATCH] chore(security): disable install scripts by default and
 narrow approved git repos in /web

Revert global enableScripts in web/.yarnrc.yml to Yarn's secure default (false) to prevent arbitrary lifecycle scripts from running on install. Allowlist only ttf2woff2 and unrs-resolver via dependenciesMeta.built in web/package.json, keeping promotional/unneeded scripts blocked. Narrow approvedGitRepositories to pgadmin-org/react-data-grid.
---
 web/.yarnrc.yml  | 4 +---
 web/package.json | 8 ++++++++
 web/yarn.lock    | 4 ++++
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/web/.yarnrc.yml b/web/.yarnrc.yml
index 9960d2bd622..49becbc3df4 100644
--- a/web/.yarnrc.yml
+++ b/web/.yarnrc.yml
@@ -1,10 +1,8 @@
 approvedGitRepositories:
-  - "**"
+  - "https://github.com/pgadmin-org/react-data-grid.git"
 
 checksumBehavior: update
 
-enableScripts: true
-
 logFilters:
   - code: YN0013
     level: discard
diff --git a/web/package.json b/web/package.json
index 02d7da03af5..b1d6ffc36b0 100644
--- a/web/package.json
+++ b/web/package.json
@@ -158,6 +158,14 @@
     "wkx": "^0.5.0",
     "zustand": "^5.0.15"
   },
+  "dependenciesMeta": {
+    "ttf2woff2": {
+      "built": true
+    },
+    "unrs-resolver": {
+      "built": true
+    }
+  },
   "resolutions": {
     "rc-resize-observer": "1.4.0",
     "@xmldom/xmldom": "^0.8.13",
diff --git a/web/yarn.lock b/web/yarn.lock
index 8c1326a41f9..2143f7aa36c 100644
--- a/web/yarn.lock
+++ b/web/yarn.lock
@@ -14558,6 +14558,10 @@ __metadata:
   dependenciesMeta:
     sharp:
       optional: true
+    ttf2woff2:
+      built: true
+    unrs-resolver:
+      built: true
   languageName: unknown
   linkType: soft