From 7dd2d680a97fcfa29c1c2a79b43ed31f2ec0a4a5 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 8 Sep 2026 20:05:21 +0000
Subject: [PATCH] Disable install scripts by default, opt in per package
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Yarn 4.18's default is `enableScripts: false`; the version bump kept the
old behaviour by setting it back to true, which re-enables arbitrary
install-time code execution for every package in the tree. Turn it off
again and opt in only where a package actually has to build something.

The list is exactly what Yarn reports as YN0004 with scripts disabled:
@parcel/watcher, @swc/core, and esbuild (keyed by bare name so it covers
both 0.25.12 and 0.27.7). electron and sharp are deliberately absent —
electron ships no lifecycle scripts and sharp resolves prebuilt binaries
through optional platform packages, so neither needs to build.

The workspace's own `postinstall` (electron-builder install-app-deps) is
unaffected: enableScripts only governs dependencies.

Verified with a from-scratch `yarn install --immutable`, the full `yarn
check`, and an `electron-builder --linux dir` pack.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BtCagWFcr4MLHQD4zkPVf5
---
 .yarnrc.yml     |  2 +-
 CONTRIBUTING.md | 17 +++++++++++++++++
 package.json    | 11 +++++++++++
 yarn.lock       |  7 +++++++
 4 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/.yarnrc.yml b/.yarnrc.yml
index 8a5324fe..5b8cbc12 100644
--- a/.yarnrc.yml
+++ b/.yarnrc.yml
@@ -1,6 +1,6 @@
 compressionLevel: mixed
 
-enableScripts: true
+enableScripts: false
 
 nodeLinker: node-modules
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a61ee7fa..51aa7cc7 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -177,6 +177,23 @@ Links:
 yarn upgrade-interactive
 ```
 
+Install scripts are disabled by default (`enableScripts: false` in `.yarnrc.yml`), so a
+compromised dependency cannot run code just by being installed. Packages that genuinely need
+to build something at install time are opted in individually under `dependenciesMeta` in
+`package.json`.
+
+If an install prints `YN0004: <package> lists build scripts, but all build scripts have been
+disabled`, decide whether that package really needs to build. If it does, add it:
+
+```json
+"dependenciesMeta": {
+  "<package>": { "built": true }
+}
+```
+
+Ignoring the warning leaves the package unbuilt, which usually surfaces later as a confusing
+runtime failure rather than an install error.
+
 ### i18n strings / Weblate
 
 Run `yarn scan-i18n` to get the newest English strings and push so Weblate gets them.
diff --git a/package.json b/package.json
index 93037d19..9c87e810 100644
--- a/package.json
+++ b/package.json
@@ -161,6 +161,17 @@
     "yargs-parser": "^22.0.0",
     "zod": "^4.4.3"
   },
+  "dependenciesMeta": {
+    "@parcel/watcher": {
+      "built": true
+    },
+    "@swc/core": {
+      "built": true
+    },
+    "esbuild": {
+      "built": true
+    }
+  },
   "build": {
     "toolsets": {
       "appimage": "1.0.3"
diff --git a/yarn.lock b/yarn.lock
index 92eca2f7..0ca38453 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9957,6 +9957,13 @@ __metadata:
     yargs: "npm:^18.0.0"
     yargs-parser: "npm:^22.0.0"
     zod: "npm:^4.4.3"
+  dependenciesMeta:
+    "@parcel/watcher":
+      built: true
+    "@swc/core":
+      built: true
+    esbuild:
+      built: true
   languageName: unknown
   linkType: soft