feat(yarn): write `npmPreapprovedPackages` entries for security updates

[RahulGautamSingh]

Discussed in #45279

^{Originally posted by MorrisonCole August 14, 2026}

Tell us more.

Split out from #45177 - this one covers Yarn only, and that discussion now covers npm.

TL;DR: Yarn equivalent of the pnpm work in #39168.

Context

Yarn 4.10.0 added npmPreapprovedPackages (yarnpkg/berry#6901), the counterpart to pnpm's minimumReleaseAgeExclude. Both the gate and the exclusions live in .yarnrc.yml:

npmMinimalAgeGate: 7d
npmPreapprovedPackages:
  - "axios@1.18.1"

It accepts full descriptors with semver ranges as well as name globs, so Renovate can write the same version-scoped entries it already writes for pnpm.

Why this is needed

Yarn applies the age gate when it resolves a package, not when it installs from the lockfile. So yarn install --immutable is fine after a Renovate security update merges - the problem is the next thing that re-resolves (yarn add, etc.).

Verified on Yarn 4.18.0, with a security fix already locked:

	Yarn 4.18.0
yarn install --immutable, cold cache	installs locked version
plain install, lockfile in sync	installs locked version
explicit yarn add, range permits an older version	silent downgrade, and package.json rewritten to the downgraded range
explicit yarn add, range pins the fix	YN0016: All versions satisfying "x" are quarantined
npmPreapprovedPackages entry present	installs the approved version

So weeks after a security fix lands, a developer running yarn add <pkg> either hits a hard error they have to work around by hand, or worse, silently reverts the fix with no warning.

An entry written by Renovate alongside the upgrade is what records "this specific version is approved" in the repo so neither happens.

Proposal

• if not a security PR, do nothing
• if npmMinimalAgeGate is set in .yarnrc.yml
• add/edit npmPreapprovedPackages, appending the name@version descriptor for the upgrade, optionally with a comment marking it as a Renovate-issued security upgrade

[jamietanna]

Similar to #43265 this should be opt-in only