Dependabot: 9 bumps deferred pending migration (sweep 2026-06-23) #344

Activity

1. rz1989s commented on Sep 22, 2026

   

   rz1989s

   on Sep 22, 2026

   Last edited by rz1989s

   MemberAuthor

   More actions

   Sweep 2026-09-22: assessed all 6 open bumps (#355, #357, #358, #365, #368, #374). Zero merged — none can go green right now, for reasons that have nothing to do with the bumps themselves. @dependabot rebase was run on all 6; Dependabot reports the branches already up-to-date with main, so staleness is ruled out. Two systemic blockers found:

   Blocker A — Dependabot-regenerated pnpm lockfiles fail frozen install (blocks #374, #358, #357)

   Every lockfile-touching Dependabot PR dies at pnpm install --frozen-lockfile with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH ("patchedDependencies configuration doesn't match the value found in the lockfile"). Reproduced on three branches three weeks apart: #374 (Sep 14, run 34855964938), #357 + #358 (Sep 22, runs 35685360497 / 35685408177). Deterministic.

   Main's lockfile records the @triton-one/yellowstone-grpc@4.0.2 patch with hash: + path: patches/... (file exists in repo) and installs fine. Dependabot's regen rewrites the patchedDependencies section into a hash-only inline entry (drops path:), which no longer passes the frozen-install consistency check against package.json — which declares no pnpm.patchedDependencies at all.

   Fix hint: reconcile patch config in a hand-rolled PR — either re-declare the yellowstone-grpc patch under pnpm.patchedDependencies in package.json, or drop the orphaned patch (lockfile + patches/ file) if it's no longer needed. Until then, Dependabot cannot produce a green lockfile-touching PR on this repo.

   Blocker B — playwright e2e broken repo-wide: empty E2E admin keypair (blocks #355, #365, #368)

   Run Playwright fails at globalSetup: secrets.E2E_ADMIN_KEYPAIR is missing/empty, so the workflow writes a 0-byte e2e/fixtures/admin-keypair.json and JSON.parse('') throws SyntaxError: Unexpected end of JSON input at e2e/fixtures/auth.ts:45 (mintAdminJwt called from globalSetup). Identical signature on Jul 20 (#365, run 29749359661), Aug 3 (#368, run 30821252488), Sep 22 (#355, run 35685288531). Not a flake — deterministic.

   On these three PRs everything else passes (test, component, Vercel; build-and-push/deploy SKIPPED as usual). Fix hint: set the E2E_ADMIN_KEYPAIR repo secret (and confirm E2E_JWT_SECRET), and/or make globalSetup throw a clear "keypair file is empty" message instead of the cryptic JSON.parse error. Until fixed, no PR can show fully green CI, which blocks every merge-by-policy.

   Per-PR disposition (all left open, Dependabot keeps them current)

   • build(deps): bump the minor-and-patch group across 1 directory with 33 updates #374 minor-and-patch group (33) — blocked by A. Contents otherwise look adoptable (the old zod/pino-http/plugin-react majors in this ledger are already the baseline on main; this group is minors/patches on top). Re-assess after A.
   • build(deps-dev): bump @types/node from 25.2.0 to 26.6.2 #358 @types/node 25→26 — blocked by A; never reached typecheck. Types-only, no objection known. Defer.
   • build(deps): bump @noble/curves from 1.9.7 to 2.4.0 #357 @noble/curves 1.9.7→2.2.0 (now targeting 2.4.0 after Dependabot's Sep 22 re-push) — blocked by A, and the 2.0.0 changelog flags real migration surface that 2.3/2.4 only harden on top of: subpath imports now require the .js suffix, ECDSA sign/verify changed defaults (prehashed, lowS, compact format, explicit der), hex-string inputs rejected; node ≥ 20.19 + ESM-only (repo is already ESM, so that part is fine). First-party code reaches curves via @sip-protocol/sdk; no direct imports found in sampled files, so CI would likely pass once A is fixed — but it needs verified-green CI before adopting. Defer.
   • build(deps): bump actions/setup-node from 6 to 7 #365 actions/setup-node 6→7 — green except e2e (B). Park until B fixed.
   • build(deps): bump pnpm/action-setup from 6 to 6.0.9 #368 pnpm/action-setup 6→6.0.9 — green except e2e (B). Park until B fixed.
   • build(deps): bump actions/checkout from 4 to 7 #355 actions/checkout 4→7 — green except e2e (B). Park until B fixed.

   Order of operations when picking this up: fix B (one secret) → merge the three workflow bumps → fix A (one lockfile/patch PR) → let Dependabot re-regen #374/#358/#357 → adopt in that order (#374 first, it absorbs overlap).
2. rz1989s commented on Sep 23, 2026

   

   rz1989s

   on Sep 23, 2026

   MemberAuthor

   More actions

   Blocker B — verdict: secret is NOT missing; Dependabot runs just can't see it (empirically settled 2026-09-23)

   Follow-up to the Sep 22 triage above. Settled empirically:

   1. The stored values are valid. gh secret list shows E2E_ADMIN_KEYPAIR + E2E_JWT_SECRET both exist (updated 2026-04-27). GitHub refused a rerun of the Jul 14 main e2e run (runs older than a month can't be rerun), so the next-best sanctioned run was used: the fresh e2e on PR #375 (same-repo human PR → Actions secrets available; diff is pnpm config only, e2e-neutral):

   • ✅ playwright PASSED — run 35813368127, job 107029561607 (1m39s, real execution): keypair file written non-empty, admin JWT minted, suite green.

   2. On Dependabot branches, both secrets arrive EMPTY — by GitHub design, not by bad values. Verbatim from the Sep 22 #355 run (35685288531), the Run Playwright step env dump literally prints:

   JWT_SECRET:
   

   (empty — same for the keypair write step), then fails exactly as triaged:

   SyntaxError: Unexpected end of JSON input
   
      at fixtures/auth.ts:45
   
   > 45 |   const secretKeyArr = JSON.parse(fs.readFileSync(keypairPath, 'utf-8')) as number[]
        |                             ^
       at mintAdminJwt (/home/runner/work/sipher/sipher/e2e/fixtures/auth.ts:45:29)
       at globalSetup (/home/runner/work/sipher/sipher/e2e/global-setup.ts:21:55)
   

   Actions repo secrets are withheld from workflows triggered by Dependabot branch PRs (that's why main and human PRs pass while all Dependabot PRs fail with the identical signature since July).

   RECTOR action for B (one-time, no code change): mirror both secrets under Settings → Secrets and variables → Dependabot → New repository secret, same names (E2E_ADMIN_KEYPAIR, E2E_JWT_SECRET). Dependabot secrets ARE injected into Dependabot-triggered runs, so #355/#365/#368 should then go green on the next CI trigger.

   Blocker A note: fix PR #375 is open (KEEP-AND-DECLARE — patch declared in package.json where pnpm 9/10 and Dependabot's updater can read it; workspace.yaml is pnpm-10-only, which is why Dependabot's regen kept mangling the lockfile). Local frozen install green on pnpm 10.34.5, patch verified still required, PR CI fully green. Ready to merge first; the 6-PR pass can start after.
3. rz1989s

   added a commit that references this issue on Sep 23, 2026

   Merge pull request #375 from sip-protocol/fix/declare-yellowstone-patch

   ...

   d533422