feat(TU-33149): Remove pinned yarn 1.18.0

[tom-ridsdale]

Problem

• release workflow failing with npm error LRU is not a constructor.

Investigation

• Reproduced locally by running the failing npm version command. Found that yarn 1.18.0's hoisting caused semver@7.5.2 to resolve lru-cache@11.x instead of ^6.0.0. The API changed between versions (new LRU() → new LRUCache()), causing the crash (couldn't find its own lru-cache@6 in its nested node_modules, so Node's resolution walked up and found the root lru-cache@11 instead).
• js-api-client works because it uses system yarn 1.22.x with correct hoisting.

Fix

• Removed pinned yarn 1.18.0 (.yarnrc, .yarn/releases/)
• Regenerated yarn.lock
• Pinned @typeform/eslint-config@6.0.3 and @visual-regression-tracker/agent-cypress@5.6.0 to prevent breaking upgrades
• Added resolution for @types/minimatch@5.1.2
• Removed stale packages/demo-nextjs/yarn.lock

[tom-ridsdale]

yarn build & yarn test running successfully locally

[gitstream-cm]

🥷 Code experts: tf-security

tf-security has most 👩‍💻 activity in the files.
tf-security has most 🧠 knowledge in the files.

See details

package.json

Activity based on git-commit:

	tf-security
DEC	1 additions & 1 deletions
NOV
OCT
SEP
AUG
JUL	82 additions & 0 deletions

Knowledge based on git-blame:
tf-security: 94%

yarn.lock

Activity based on git-commit:

	tf-security
DEC	57 additions & 57 deletions
NOV
OCT
SEP
AUG
JUL	18497 additions & 0 deletions

Knowledge based on git-blame:
tf-security: 89%

✨ Comment /gs review for LinearB AI review. Learn how to automate it here.

[typeform-ops-gha]

[BOT] Preview available with hash 1d0107618edc1a325100792eb5b74d2a7b4a70e2 here.

[sonarqubecloud]

Quality Gate passed

Issues
60 New issues
0 Accepted issues

Measures
1 Security Hotspot
76.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud