chore: Bump Yarn to 4.10.3 and configure NPM age gate

[Mrtenz]

Explanation

This bumps Yarn to the latest version (4.10.3), which includes support for setting an age gate for NPM packages. It's set to 3 days following the security recommendations, meaning that packages must be at least 3 days old to be installed.

References

MetaMask/metamask-module-template#270

---

Note

Upgrades Yarn to 4.10.3, adds a 3-day npm age gate with preapproved packages, and updates related configs and LavaMoat policy references.

• Build/Config:
  • Yarn upgrade: Set yarnPath and root packageManager to [email protected] in .yarnrc.yml, package.json, and yarn.config.cjs.
  • NPM age gate: Add npmMinimalAgeGate: 4320 and npmPreapprovedPackages (@metamask/*, @lavamoat/*) in .yarnrc.yml.
• LavaMoat policy:
  • Update policy.json to reference depcheck>readdirp>picomatch instead of ts-loader>micromatch>picomatch in relevant entries.

^{Written by Cursor Bugbot for commit 635d8c1. This will update automatically on new commits. Configure here.}

[Gudahtt]

Those are some interesting CI failures

[Mrtenz]

@metamaskbot update-pr

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.29%. Comparing base (fff1ef6) to head (635d8c1).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3691   +/-   ##
=======================================
  Coverage   98.29%   98.29%           
=======================================
  Files         417      417           
  Lines       11925    11925           
  Branches     1851     1851           
=======================================
  Hits        11722    11722           
  Misses        203      203           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Gudahtt]

LGTM!