approvedGitRepositories is a Yarn setting that holds URL glob patterns of git repositories you allow. When it is set, Yarn blocks any git dependency whose normalized repository URL does not match one of the patterns. GitHub repositories must be explicitly approved, so an empty match means nothing from GitHub installs.
What the docs say
The Yarn configuration reference defines the setting as an array of git repository URL glob patterns that are allowed to be fetched. The example shows both an https and an ssh form for the same organization:
# .yarnrc.yml
approvedGitRepositories:
- "https://github.com/yarnpkg/*"
- "ssh://git@github.com/yarnpkg/*"
Two behaviors stand out. First, the allowlist only takes effect once you set it. Second, GitHub repositories are not implicitly trusted: you must approve them like any other host.
Why git dependencies deserve a gate
A git dependency bypasses registry controls. There is no registry publish date for an age gate, no registry provenance, and a branch or tag can point at different code tomorrow than it did when you reviewed it. A commit hash pins the content, but only if you use one.
Git dependencies also tend to arrive through other packages. A library can reference a repository in its own manifest, and your install follows it.
Writing patterns that are narrow enough
| Pattern idea | Risk level |
|---|---|
| One specific repository URL | Low, you can review it |
| Your own organization on a code host | Moderate, only as safe as your org's access controls |
| A whole host or a broad wildcard | High, defeats the purpose |
Prefer exact repositories for third party code and an organization wildcard only for repositories you own. Remember to cover both url forms (https and ssh) if your tree uses both, since the docs match on the normalized URL.
Rollout steps
- Find current git dependencies. For npm-style trees,
npm query ":type(git)"lists them, and our guide to finding git URL dependencies covers more cases. In Yarn, read the lockfile for git sources. - Decide for each one whether it should exist. Many can move to a registry release.
- Add the survivors to approvedGitRepositories.
- Run a clean install in CI so a new git dependency fails the build instead of arriving silently.
- Pin each remaining git dependency to a full commit hash.
What the setting does not cover
It does not look inside an approved repository. It decides where code may come from, not whether the code is good. A repository you approved can still change, which is why a commit pin and review of updates still matter.
Where Safeguard fits
Safeguard's SBOM and dependency scanning list the components your lockfiles resolve, including their sources, and policies and gates can flag a pull request that introduces an unexpected one. Use the free scan at https://gold.safeguard.sh/scan to see what your project resolves today.
Quick check
Are GitHub repositories trusted automatically when approvedGitRepositories is set?
No. The Yarn docs state that GitHub repositories must be explicitly approved.
Does the allowlist guarantee the code in an approved repository is safe?
No. It only controls which repositories Yarn may fetch from. Pin to a commit hash and review updates.
Sources
Last reviewed: 19 October 2026.
