Pin the Yarn bootstrap and add SHA-512 lock checksums

[Sean McManus (sean-mcmanus)]

Summary

Two independent Yarn hardening changes, both using only supported package-manager behavior — no new scripts or custom tooling.

• Extension/yarn.lock now carries SHA-512 integrity alongside the existing SHA-1 for all 932 entries, produced by Yarn's supported yarn install --update-checksums. Yarn's bundled ssri selects the strongest listed digest, so SHA-512 is the value actually enforced on install.
• npm run bootstrap now installs Yarn from the already-present but previously unused Extension/.yarn-bootstrap/package-lock.json, instead of re-resolving yarn@1.22.22 from the feed on every run with nothing pinning the result.

This retains only the supported-package-manager portion of #14701, which was closed without merging.

Notes for reviewers

• The yarn.lock diff is large but entirely mechanical. All 1864 changed lines are integrity values; no package version, resolution URL, or dependency edge changed.
• The retained SHA-1 is not a downgrade. Yarn 1 writes integrity "sha1-… sha512-…", keeping both. Its bundled ssri picks the strongest algorithm present, so SHA-512 is what gets verified. Verified directly: corrupting one entry's SHA-512 while leaving its SHA-1 correct makes yarn install --frozen-lockfile fail with Integrity check failed.
• Regenerating this lockfile needs a cold Yarn cache and --force. With a warm tree yarn install --update-checksums reports success Already up-to-date and changes nothing; with a warm cache it upgrades only some entries. A useful completeness check is that the count of integrity "sha1-… sha512-…" lines equals the total integrity line count (932).
• Extension/.yarn-bootstrap/{package.json,package-lock.json} already existed in the repository but were referenced by nothing. Its single entry keeps its SHA-1 value, which npm accepts.
• The two commits are separated so the mechanical lockfile churn can be reviewed apart from the two-line bootstrap change.

Validation

• Clean-tree, cold-cache yarn install --frozen-lockfile succeeds and leaves the lockfile unchanged.
• SHA-512 enforcement verified by the corruption test described above (exit 1, Integrity check failed).
• Lockfile generation is reproducible: three independent cold-cache runs produced byte-identical output.
• Both halves of the new bootstrap:yarn run clean and yield Yarn 1.22.22.
• yarn verify-yarn-lock passes, yarn test-yarn-lock passes, and git diff --check is clean.

This PR was investigated and created by Copilot with Claude Opus 5 (in VS Code). Any message starting with ✨Copilot: was sent by Copilot.

[Copilot]

Pull request overview

Pins the Yarn bootstrap install and strengthens dependency verification with SHA-512 integrity hashes.

Changes:

• Installs Yarn 1.22.22 using the existing pinned npm lockfile.
• Adds SHA-512 integrity values to all 932 Yarn lock entries.
• Documents the revised bootstrap process.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
Extension/package.json	Uses the pinned bootstrap package for global Yarn installation.
Extension/yarn.lock	Adds SHA-512 checksums alongside SHA-1.
Extension/readme.developer.md	Documents pinned Yarn bootstrap behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.