chore: block compromised npm releases & pin known-good versions (2025-09-08)

Add comprehensive security measures to prevent malicious package versions:

✅ Added Yarn constraints blocklist (.yarn/constraints.pro)
- Blocks 19 malicious versions of compromised packages
- Prevents installation of known bad releases
- Covers color, chalk, and related dependency chains

✅ Pinned exact safe versions via resolutions (package.json)
- color: 4.2.3 (last known good)
- color-string: 1.9.1 (last known good)
- color-convert: 2.0.1 (last known good)
- color-name: 1.1.4 (last known good)
- chalk: 4.1.2 (last known good)
- Plus 13 additional related packages

Author: rhyslbw

.yarn/constraints.pro

@@ -1,2 +1,19 @@
-# Yarn constraints for security policy enforcement
-# Add constraint rules here to prevent malicious package versions
+gen_enforced_dependency ForbidMaliciousReleases:
+  backslash "!=0.2.1"
+  chalk-template "!=1.1.1"
+  supports-hyperlinks "!=4.1.1"
+  has-ansi "!=6.0.1"
+  simple-swizzle "!=0.2.3"
+  color-string "!=2.1.1"
+  error-ex "!=1.3.3"
+  color-name "!=2.0.1"
+  is-arrayish "!=0.3.3"
+  slice-ansi "!=7.1.1"
+  color-convert "!=3.1.1"
+  wrap-ansi "!=9.0.1"
+  ansi-regex "!=6.2.1"
+  supports-color "!=10.2.1"
+  strip-ansi "!=7.1.1"
+  chalk "!=5.6.1"
+  debug "!=4.4.2"
+  ansi-styles "!=6.2.2"

package.json

@@ -93,5 +93,26 @@
     "typedoc-plugin-missing-exports": "^1.0.0",
     "typescript": "^4.7.4"
   },
-  "packageManager": "[email protected]"
+  "packageManager": "[email protected]",
+  "resolutions": {
+    "color": "4.2.3",
+    "color-string": "1.9.1",
+    "color-convert": "2.0.1",
+    "color-name": "1.1.4",
+    "chalk": "4.1.2",
+    "chalk-template": "1.1.0",
+    "wrap-ansi": "9.0.0",
+    "slice-ansi": "7.1.0",
+    "strip-ansi": "7.1.0",
+    "ansi-styles": "6.2.1",
+    "ansi-regex": "6.0.1",
+    "supports-color": "10.1.0",
+    "supports-hyperlinks": "4.0.0",
+    "debug": "4.3.4",
+    "is-arrayish": "0.3.2",
+    "simple-swizzle": "0.2.2",
+    "error-ex": "1.3.2",
+    "has-ansi": "5.0.1",
+    "backslash": "0.2.0"
+  }
 }