[RichDom2185]

Description

Closes #4047

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• Code quality improvements

How to test

Everything should still work

Checklist

• I have tested this code
• I have updated the documentation

---

This is part 1 of 2 in a stack made with GitButler:

•  2  Set up Knip for codebase maintenance #4052
•  1  Delete unused dependencies and upgrade Yarn #4051 👈

[coderabbitai]

Walkthrough

This PR updates .yarnrc.yml to add a wildcard approved Git repository list and enable scripts, reformats the preapproved packages list, bumps the pinned Yarn version in package.json, and removes several unused dependencies and devDependencies.

Changes

Yarn tooling and dependency cleanup

Layer / File(s)	Summary
Yarn configuration update .yarnrc.yml	Adds approvedGitRepositories wildcard entry, enables enableScripts, and reformats npmPreapprovedPackages entries with unquoted values and a consolidated comment.
Package manager bump and dependency cleanup package.json	Bumps packageManager to a pinned Yarn 4.17.0, and removes unused dependencies (array-move, hastscript, js-yaml, mdast-util-from-markdown, mdast-util-to-hast, normalize.css, react-debounce-render, rehype-react, unified, yareco) and devDependencies (@types/js-yaml, @types/react-copy-to-clipboard, npm-run-all2, phaser3spectorjs).

Estimated code review effort: 2 (Simple) | ~10 minutes

Related PRs: None found.

Suggested labels: dependencies, chore

Suggested reviewers: None identified.

---

🐰 A hutch of dependencies swept clean away,
Yarn hums a newer tune today,
Scripts enabled, repos approved with care,
Packages trimmed—less clutter, less to bear.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the main change: removing unused dependencies and upgrading Yarn.
Description check	✅ Passed	The description follows the required template and includes the issue, change type, and a test note, though the summary and test details are sparse.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates Yarn to version 4.17.0 and removes several unused dependencies and devDependencies from the project. However, the configuration changes in .yarnrc.yml introduce significant supply-chain security risks. Specifically, allowing any Git repository with a wildcard pattern and globally enabling lifecycle scripts should be avoided. It is highly recommended to restrict approved Git repositories to trusted domains and disable global script execution, enabling scripts selectively instead.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.yarnrc.yml:
- Around line 1-2: Restrict the approvedGitRepositories setting so it only
allows Source Academy-owned git repositories instead of the current wildcard.
Update the .yarnrc.yml configuration to replace the catch-all entry with the
specific Source Academy repository patterns you actually depend on, and include
the matching SSH form if required.
- Line 4: The current Yarn configuration globally enables lifecycle scripts,
which should be avoided. Update the .yarnrc.yml setting so scripts remain
disabled by default, and instead opt in only for the specific dependencies that
require builds by using dependenciesMeta with the built flag in the relevant
package manifests. This change should be applied where enableScripts is
currently set and reviewed alongside any packages that actually need script
execution.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 9e0a3182-58fd-42b5-9698-a4299182656d

📥 Commits

Reviewing files that changed from the base of the PR and between db37b17 and 7ed5924.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• .yarnrc.yml
• package.json

[coveralls]

Coverage Report for CI Build 28637853353

Coverage remained the same at 41.192%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	13851
Covered Lines:	6154
Line Coverage:	44.43%
Relevant Branches:	7413
Covered Branches:	2605
Branch Coverage:	35.14%
Branches in Coverage %:	Yes
Coverage Strength:	26.94 hits per line

---

💛 - Coveralls

[martin-henz]

LGTM