chore(security): restore checksumBehavior to throw in web and runtime

[dev-hari-prasad]

Part of #10363 (Item 4 from the tracking table).

This PR switches checksumBehavior from update back to Yarn's default (throw) in both web/.yarnrc.yml and runtime/.yarnrc.yml.

Addressing Dave's Concerns

In #10363, Dave rightly cautioned:

"I'd like it back at throw, but it needs doing carefully and on its own: the original mismatch wants understanding and the lockfile checksums regenerating first, otherwise CI goes red the moment it lands and we'll be tempted to paper over it the same way again."

To be completely certain this won't break CI, I investigated and tested both directories with checksumBehavior: throw enabled:

1. runtime/:
   • yarn install --immutable → Passed (Exit code 0)
   • yarn install --check-cache --immutable → Passed (Exit code 0)
2. web/:
   • yarn install --immutable → Passed (Exit code 0)
   • yarn install --check-cache --immutable → Passed (Exit code 0)

The --check-cache run forced Yarn to re-verify every single package archive against the remote npm registry. Zero mismatches were found, confirming that the historical 2023 mismatch is resolved and our lockfiles are 100% consistent today.

Changes

• Changed checksumBehavior: update to checksumBehavior: throw in web/.yarnrc.yml
• Changed checksumBehavior: update to checksumBehavior: throw in runtime/.yarnrc.yml

Background

Why was it originally set to update?

Back in July 2023 (commit 25e05de27), checksumBehavior: update was added to get around failing GitHub Actions test cases caused by a Yarn checksum error during the transition to Yarn Berry. While that unblocked CI at the time, leaving it set to update permanently silenced Yarn's checksum mismatch detection across both web/ and runtime/

Summary by CodeRabbit

• Chores
  • Package installation now fails when dependency checksums do not match, rather than silently updating them.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 3d1cf453-5de4-46c3-93db-e9e3626f3333

📥 Commits

Reviewing files that changed from the base of the PR and between bd7cde5 and a4220d0.

📒 Files selected for processing (2)

• runtime/.yarnrc.yml
• web/.yarnrc.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

Walkthrough

Yarn checksum handling changes from silently updating mismatches to throwing errors in both the runtime and web configurations.

Changes

Yarn checksum enforcement

Layer / File(s)	Summary
Configure checksum failure behavior runtime/.yarnrc.yml, web/.yarnrc.yml	checksumBehavior changes from update to throw in both Yarn configurations.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to a4220

Runtime and web dependency installs now reject checksum mismatches rather than updating lockfile checksums. The configurations are aligned, with no current merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: restoring Yarn checksum verification in both the web and runtime configurations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}