From 351376af7f509fa319515a43688b9877c26f1346 Mon Sep 17 00:00:00 2001
From: dev-hari-prasad <webdev.byhari@gmail.com>
Date: Tue, 22 Sep 2026 16:50:39 +0100
Subject: [PATCH] Enforce --immutable on every yarn install, in CI and the
 release builds (#10389)

In the four GitHub Actions workflows the flag is documentation only, since
Yarn's enableImmutableInstalls already defaults to true whenever CI is set in
the environment, but making it explicit means the intent is visible in the
workflow rather than implied by the runner.

The six installs that run outside CI are where this actually changes
behaviour: the Makefile, the Dockerfile, and the pip, Linux, macOS and Windows
packaging builds all run with yarn.lock beside them, and until now any of them
would quietly rewrite the lockfile rather than fail. A release build that
rewrites the lockfile is shipping something other than what we reviewed, so
failing loudly there is the point of the exercise.
---
 .github/workflows/check-javascript-style.yml | 2 +-
 .github/workflows/run-feature-tests-epas.yml | 2 +-
 .github/workflows/run-feature-tests-pg.yml   | 2 +-
 .github/workflows/run-javascript-tests.yml   | 2 +-
 Dockerfile                                   | 2 +-
 Make.bat                                     | 2 +-
 Makefile                                     | 2 +-
 pkg/linux/build-functions.sh                 | 2 +-
 pkg/mac/build-functions.sh                   | 2 +-
 pkg/pip/build.sh                             | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/check-javascript-style.yml b/.github/workflows/check-javascript-style.yml
index 4de538ba3..6bea37ee9 100644
--- a/.github/workflows/check-javascript-style.yml
+++ b/.github/workflows/check-javascript-style.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Install Node modules
         run: |
           cd web
-          yarn install
+          yarn install --immutable
 
       - name: Run the linter
         run: |
diff --git a/.github/workflows/run-feature-tests-epas.yml b/.github/workflows/run-feature-tests-epas.yml
index 480fced2c..c8b09b094 100644
--- a/.github/workflows/run-feature-tests-epas.yml
+++ b/.github/workflows/run-feature-tests-epas.yml
@@ -170,7 +170,7 @@ jobs:
       - name: Build the JS bundle
         run: |
           cd web
-          yarn install
+          yarn install --immutable
           yarn run bundle
 
       - name: Run the tests
diff --git a/.github/workflows/run-feature-tests-pg.yml b/.github/workflows/run-feature-tests-pg.yml
index 13cf5052e..23d43929c 100644
--- a/.github/workflows/run-feature-tests-pg.yml
+++ b/.github/workflows/run-feature-tests-pg.yml
@@ -180,7 +180,7 @@ jobs:
       - name: Build the JS bundle
         run: |
           cd web
-          yarn install
+          yarn install --immutable
           yarn run bundle
 
       - name: Run the tests
diff --git a/.github/workflows/run-javascript-tests.yml b/.github/workflows/run-javascript-tests.yml
index 82ee74353..cdec6963c 100644
--- a/.github/workflows/run-javascript-tests.yml
+++ b/.github/workflows/run-javascript-tests.yml
@@ -59,7 +59,7 @@ jobs:
       - name: Install Node modules
         run: |
           cd web
-          yarn install
+          yarn install --immutable
 
       - name: Run the tests
         run: |
diff --git a/Dockerfile b/Dockerfile
index 6d0bf273a..d4e2cb086 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -42,7 +42,7 @@ RUN --mount=type=bind,source=.git,target=/pgadmin4/.git \
     export CPPFLAGS="-DPNG_ARM_NEON_OPT=0" && \
     npm install -g corepack && \
     corepack enable && \
-    yarn install && \
+    yarn install --immutable && \
     yarn run bundle && \
     rm -rf yarn.lock \
            package.json \
diff --git a/Make.bat b/Make.bat
index 113a48e4d..0efed2737 100644
--- a/Make.bat
+++ b/Make.bat
@@ -283,7 +283,7 @@ REM Main build sequence Ends
         EXIT /B 1
     )
     CALL yarn set version %YARN_VERSION% || EXIT /B 1
-    CALL yarn install || EXIT /B 1
+    CALL yarn install --immutable || EXIT /B 1
     CALL npm rebuild || EXIT /B 1
 
     ECHO Bundling javascript...
diff --git a/Makefile b/Makefile
index 8865a41f8..3303a5358 100644
--- a/Makefile
+++ b/Makefile
@@ -25,7 +25,7 @@ appbundle:
 	./pkg/mac/build.sh $(BUILD_OPTS)
 
 install-node:
-	cd web && yarn install
+	cd web && yarn install --immutable
 
 install-python:
 	./tools/setup-python-env.sh
diff --git a/pkg/linux/build-functions.sh b/pkg/linux/build-functions.sh
index a98e42cbc..f2972f3c8 100644
--- a/pkg/linux/build-functions.sh
+++ b/pkg/linux/build-functions.sh
@@ -304,7 +304,7 @@ _copy_code() {
             exit 1
         fi
         yarn set version "${YARN_VERSION}"
-        yarn install
+        yarn install --immutable
         yarn run bundle
     popd > /dev/null || exit
 
diff --git a/pkg/mac/build-functions.sh b/pkg/mac/build-functions.sh
index cbdc77658..33c884dd3 100644
--- a/pkg/mac/build-functions.sh
+++ b/pkg/mac/build-functions.sh
@@ -319,7 +319,7 @@ _complete_bundle() {
             exit 1
         fi
         yarn set version "${YARN_VERSION}"
-        yarn install 2>&1
+        yarn install --immutable 2>&1
 
         # Record the source commit hash before the heavy lint/webpack
         # steps. `yarn run` needs node_modules so this runs after install,
diff --git a/pkg/pip/build.sh b/pkg/pip/build.sh
index 35e5ed669..629eb9c92 100755
--- a/pkg/pip/build.sh
+++ b/pkg/pip/build.sh
@@ -62,7 +62,7 @@ if [ -z "${YARN_VERSION}" ]; then
     exit 1
 fi
 yarn set version "${YARN_VERSION}"
-yarn install
+yarn install --immutable
 yarn run bundle
 
 # Copy the commit_hash file, it doesn't show up in git ls-files