Fix yarn berry hosted pin leaking npm auth (#404) - #465

Merged

Mikola Lysenko (mikolalysenko) merged 16 commits into

mainfrom

agent/fix-yarn-berry-hosted-auth-leak

Oct 2, 2026

Commits on Oct 1, 2026

Start fix for #404
Claude (claude)
committed
e26a1e8
Stop yarn berry pins leaking npm auth tokens
Claude (claude)
committed
e20d139
Keep hosted berry pins in the lock inventory
Claude (claude)
committed
5229052
Merge main into agent/fix-yarn-berry-hosted-auth-leak
Claude (claude)
committed
0c461dc
Pin yarn berry patches through resolutions
Claude (claude)
committed
4a47781
Cover the resolutions pin in goldens and docs
Claude (claude)
committed
e0b225a
Merge main into agent/fix-yarn-berry-hosted-auth-leak
Claude (claude)
committed
ac8c443
Address review findings on berry pin
Claude (claude)
committed
80e4752
Match berry lock keys on CRLF locks too
Claude (claude)
committed
f44ebc6

Commits on Oct 2, 2026

Confirm berry pins only with manifest routing
Claude (claude)
committed
86bd246
Own berry deps only when the lock pins them
Claude (claude)
committed
0440962
Merge main into agent/fix-yarn-berry-hosted-auth-leak
Claude (claude)
committed
3bc0d7e
Harden berry pin writes and refused locks
Claude (claude)
committed
68547b1
Merge main into agent/fix-yarn-berry-hosted-auth-leak
Claude (claude)
committed
236d4f3
Clarify when the berry pin edits package.json
Claude (claude)
committed
dc9330f
Leave yarn berry fork aliases untouched
Claude (claude)
committed
8d52ba6