chore: Update yarn to yarn-4.9.1

[andy-knock]

Yarn upgrade:

• Upgrades docs to Yarn 4 (4.9.1).
• Bundles the Yarn 4.9.1 binary at docs/.yarn/releases/yarn-4.9.1.cjs and activates it via yarnPath in docs/.yarnrc.yml — matches the approach used in the Telegraph and JS SDK repos, and works correctly regardless of what's installed globally.
• Keeps yarn 1.22.10 in .tool-versions as the asdf bootstrap; Yarn 1 reads .yarnrc.yml on startup and re-executes via the bundled 4.9.1 binary automatically.
• Adds yarn: >=4.0.0 to engines in dashboard/package.json so running Yarn 1 directly produces a clear error instead of silently corrupting the lockfile.
• Adds nodeLinker: node-modules to dashboard/.yarnrc.yml to avoid PnP compatibility issues with Next.js.
• Regenerates yarn.lock in Yarn 4 format.
• Pins @types/react and @types/react-dom in resolutions to prevent Yarn 4's stricter deduplication from pulling in a nested conflicting copy of @types/react via @types/react-dom.
• Updates CI to use yarn install --immutable (Yarn 4 flag).
• Adds .yarn/install-state.gz to dashboard/.gitignore.
• Updates README.md, bin/bootstrap.sh, and .cursor/environment.json for the new setup.

New files:

• .yarnrc.yml — configures nodeLinker: node-modules and yarnPath: .yarn/releases/yarn-4.9.1.cjs
• .yarn/releases/yarn-4.9.1.cjs — the bundled Yarn 4 binary

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 21, 2026 4:18pm

[andy-knock]

• chore: Update yarn to yarn-4.9.1 #1399 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[andy-knock]

I must note the yarn updation migration created one of these files

.yarnrc.yml, with nodeLinker set to nodeModules, which I believe was undesired behavior.

So I reverted that change and added to git ignore.

Its undesired bc we use pnp?

[kylemcd]

can reference this PR for how to do this

https://github.com/knocklabs/control/pull/8385

[andy-knock]

can reference this PR for how to do this

knocklabs/control#8385

Will fix

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9574432. Configure here.}

[cursor]

CI dependency caching removed without replacement

Low Severity

The old workflow cached yarn dependencies via actions/cache@v4, but this was removed during the Yarn 4 migration without adding any replacement caching mechanism. Every CI run now does a full yarn install from scratch. The actions/setup-node@v4 action supports built-in dependency caching via the cache input (e.g., cache: 'yarn'), but it's not being used here. Note that corepack enable would likely need to run before setup-node for Yarn Berry cache detection to work correctly.

 

^{Reviewed by Cursor Bugbot for commit 9574432. Configure here.}

[cursor]

Risk HIGH: Upgrades the project from Yarn 1 to Yarn 4.9.1, bundling the new binary, regenerating the lockfile, updating CI workflow, and modifying package.json with new resolutions and engine constraints.

Reasons

• package.json is modified with new resolutions, engines, packageManager field, and inlined pre-scripts (HIGH trigger: rule 2)
• yarn.lock is fully regenerated in Yarn 4 format with ~16k lines changed (HIGH trigger: rule 2)
• .github/workflows/cicd.yml build/deployment configuration is modified — removes yarn caching, adds corepack, switches to --immutable (HIGH trigger: rule 3)
• New .yarnrc.yml config file introduces nodeLinker and yarnPath settings that change how dependency resolution works
• bin/bootstrap.sh removes the asdf plugin add yarn step, changing the developer setup flow

Notes

• Verify the Vercel preview deployment builds and runs correctly with the new Yarn 4 setup (preview appears to be deployed successfully per the Vercel bot comment)
• Confirm that corepack enable works reliably in CI and that yarn install --immutable enforces the lockfile as expected
• Review the package.json script changes: predev/prebuild hooks were removed and their logic inlined into dev/build — ensure Yarn 4 does not also run pre hooks (which could cause double execution)
• Check that the @types/react and @types/react-dom resolution pins to 19.2.2 don't conflict with the actual React version used
• The new glob dependency (^10.3.10) was added — confirm this is intentionally part of this PR and not an unrelated change

  

_{Sent by Cursor Automation: Docs PR classifier}