[Feature]: Add support for restricting dependency downloads to a list of allowed registries/URLs

[jgf5013]

• I'd be willing to implement this feature (contributing guide)
• This feature is important to have in this repository; a contrib plugin wouldn't do

Describe the user story

As a result of the many recent supply chain attacks, I'm looking for a way to prevent yarn from installing dependencies from any registry or location other than a specific list of allowed resources.

Describe the solution you'd like

For instance, maybe a configuration like the following

allowedDependenciesUrls
  - registry.npmjs.org/*
  - my-private-registry.com/*
  - some-mirror.edu/*

And with a default value of the following if not set

allowedDependenciesUrls
  - registry.npmjs.org/*

If a sub-dependency of https://my-secure-registry-bucket.s3.amazonaws.com/evil/some-dep-1.2.3.tgz were requested, the install would fail.

Describe the drawbacks of your solution

I'm not familiar with the how package managers are actually built but I think

• There could be overlapping concerns with such a setting and other yarn settings like approvedGitRepositories and enableHardenedMode
• I would think in the future there may be some dependency standards group that would define a consistent way for npm, yarn, pnpm, bun, etc. to all do this in the same way and this might have to then be updated later

Describe alternatives you've considered

• Using approvedGitRepositories - but my understanding is that this setting does cover non-git URLs like malicious s3 buckets
• Switch to another package manager

Other Notes

I haven't contributed to yarn before but I'm open to doing so. I didn't see the same request already so hopefully this issue isn't already covered somewhere else (apologies if it is.)

[yeikel]

I think discoverability of this issue would improve if the title were updated to clearly reference registry restrictions specifically. The current title wording could be interpreted as overlapping with existing functionality such as npmPreapprovedPackages.

My suggestion is to change it to something like this or similar:

“Add support for restricting dependency downloads to a list of allowed registries/URLs”

[jgf5013]

I think discoverability of this issue would improve if the title were updated to clearly reference registry restrictions specifically. The current title wording could be interpreted as overlapping with existing functionality such as npmPreapprovedPackages.

My suggestion is to change it to something like this or similar:

“Add support for restricting dependency downloads to a list of allowed registries/URLs”

@yeikel works for me - updated it ✅