fix(PLT-3359): harden yarn configuration

[tf-seti]

Harden yarn configuration

This PR hardens yarn configuration against supply chain attacks.

Changes

• .yarnrc: Added ignore-scripts true and save-exact true.
• Dependabot: Added a 7-day cooldown for third-party npm updates (excluding @typeform/*).
• Compatibility: Maintained semantic-release version locks for Node 22 compatibility.

---

Automated by Application Security · supply-chain-hardening

Created by Sourcegraph batch change david.salvador/harden-yarn-config.

[pr-auditor]

✅ Security Analysis Results

Great news! No security issues found in this pull request.

Analysis Summary:

• 📁 Files reviewed: 2
• ✅ No security vulnerabilities detected

---

Security analysis powered by Claude Sonnet 4.6 via pr-auditor | Questions? Contact #dx-team or check out this page

[gitstream-cm]

🥷 Code experts: No results found

No code experts were identified for the files in this pull request based on git blame analysis.

This may occur when:

• Files are new or have limited commit history
• Git authors aren't mapped to current team members
• Analysis thresholds need adjustment

If you expected to see expert suggestions, consider:

• Reviewing your config.user_mapping settings

• Adjusting the gt/lt parameters in your action

• Verifying files have sufficient commit history

To learn more about /:\gitStream - Visit our Docs

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[typeform-ops-gha]

[BOT] Preview available with hash 9dbe63916aff11a822033dcf889d452f388751d0 here.