install: fix default-trusted lifecycle scripts being blocked after yarn.lock migration - #38795

Open

robobun wants to merge 7 commits into

mainfrom

farm/3e678c3b/yarn-migration-registry-url-hash

Commits on Aug 15, 2026

install: drop yarn's #sha1 suffix from migrated tarball URLs and keep registry entries as npm packages
robobun
committed
8e91b5f
install: keep the integrity comment next to the tarball fallback it describes
robobun
committed
6a82230
install: shorten the yarn migration comments
robobun
committed
0f4989b
install: strip yarn's hash once per entry and stop reading github.com tarball downloads as git dependencies
robobun
committed
fc7f7f9
install: ignore yarn's #sha1 suffix when checking a default-trusted package's tarball URL
robobun
committed
107a7bd
install: tighten two comments
robobun
committed
30251b7
ci: retrigger
robobun
committed
ec15522