fix(ci): declare yellowstone-grpc patch in package.json so frozen install resolves (Blocker A of #344)

[rz1989s]

Implements the KEEP-AND-DECLARE fix for Blocker A documented in #344 (Sep 22 comment). Does not merge any dependency bumps — it unblocks the 6-PR pass that starts after this merges.

Root cause (reproduced, deterministic)

pnpm install --frozen-lockfile on every lockfile-touching Dependabot branch fails:

ERR_PNPM_LOCKFILE_CONFIG_MISMATCH  Cannot proceed with the frozen installation. The current "patchedDependencies" configuration doesn't match the value found in the lockfile

• Main declares the @triton-one/yellowstone-grpc@4.0.2 patch only in pnpm-workspace.yaml — a settings location only pnpm 10 reads. CI/Docker pin pnpm 10, so main installs fine.
• Dependabot's updater pnpm cannot read that declaration, so its lockfile regen normalizes the section to a hash-only inline entry (drops path:), e.g. on build(deps): bump the minor-and-patch group across 1 directory with 33 updates #374:

# main (pnpm 10):                       # dependabot regen:
patchedDependencies:                    patchedDependencies:
  '@triton-one/yellowstone-grpc@4.0.2':   '@triton-one/yellowstone-grpc@4.0.2': 3c931d…
    hash: 3c931d…
    path: patches/@triton-one__….patch

• pnpm 10's frozen check then rejects the hash-only entry against the declared {hash, path} config. Reproduced locally with pnpm 10.34.5 on origin/dependabot/npm_and_yarn/minor-and-patch-e6685aadf7.

Change

KEEP-AND-DECLARE: move the explicit declaration into package.json (pnpm.patchedDependencies) — the classic location read by pnpm 9, pnpm 10, and Dependabot — and remove it from pnpm-workspace.yaml. Two files, no lockfile change.

Patch is still required — not dropped

Patch 3e07c9c (fixes sip-protocol#1077) adds {"type":"module"} / {"type":"commonjs"} markers to dist/esm/ of the pinned @triton-one/yellowstone-grpc@4.0.2; without them tsx fails to resolve named ESM imports. The npm tarball is immutable and still lacks the markers (patch applies cleanly), so it cannot be obsolete.

Verified locally (pnpm 10.34.5 — CI's major)

• pnpm install --frozen-lockfile → green; patch applied (dist/esm/package.json = {"type":"module"} present in node_modules)
• Full regen pnpm install --no-frozen-lockfile → pnpm-lock.yaml byte-identical to main (zero diff)
• Frozen check matrix: {hash,path} lockfile + either declaration site → green; hash-only lockfile → red at both declaration sites

What this fixes and what it doesn't

• After merge, Dependabot regens on build(deps): bump the minor-and-patch group across 1 directory with 33 updates #374/build(deps-dev): bump @types/node from 25.2.0 to 26.6.2 #358/build(deps): bump @noble/curves from 1.9.7 to 2.4.0 #357 should carry the patch (its updater reads package.json). If a branch still holds its already-mangled lockfile, @dependabot rebase forces a regen; worst case the lockfile gets the one-command hand regen per the standing playbook.
• The 6-PR pass stays gated on RECTOR merging this first (per Dependabot: 9 bumps deferred pending migration (sweep 2026-06-23) #344 order of operations; note Dependabot: 9 bumps deferred pending migration (sweep 2026-06-23) #344's own order says fix B first — B is being settled empirically in parallel, see the issue for the verdict).
• Optional hardening (not in this PR): add "packageManager": "pnpm@10…" so Dependabot/corepack provision pnpm 10 directly — happy to follow up if wanted.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sipher	Ready	Preview	Sep 23, 2026 3:11am UTC