Merge pull request #156 from Typeform/appsec/harden-yarn-config

fix(PLT-3359): harden yarn configuration

Author: Thr44

.github/dependabot.yml

@@ -1,5 +1,4 @@
 version: 2
-
 registries:
   npm-github:
     type: npm-registry
@@ -10,7 +9,6 @@ registries:
     url: https://github.com
     username: x-access-token
     password: '${{ secrets.GH_TOKEN }}'
-
 updates:
   - package-ecosystem: npm
     schedule:
@@ -27,7 +25,11 @@ updates:
     registries:
       - npm-github
       - git-github
-
+    cooldown:
+      default:
+        days: 7
+      exclude-patterns:
+        - "@typeform/*"
   - package-ecosystem: github-actions
     schedule:
       interval: weekly

.yarnrc

@@ -0,0 +1,2 @@
+ignore-scripts true   # blocks all postinstall scripts
+save-exact true       # forces exact pins on yarn add