feat: use patch-package for SES-compat patches; expose patches in published packages

[rekmarks]

Summary

@metamask/ocap-kernel and @metamask/kernel-utils depend on @chainsafe/libp2p-yamux@7.0.4, which requires a patch for SES/lockdown compatibility (Object.defineProperty instead of direct assignment on a frozen iterator). Previously the patch was applied via Yarn's patch: protocol from a root .yarn/patches/ file — invisible to and unreproducible by consumers.

This PR switches to patch-package (package manager-agnostic) and bundles the patch in the published npm tarballs so consumers can apply it without visiting GitHub.

Changes

• Replace the Yarn patch: URL for @chainsafe/libp2p-yamux in all three dependent packages (ocap-kernel, kernel-utils, brow-2-brow) with a plain 7.0.4 version specifier
• Add patch-package as a root devDependency; prepend patch-package to the root postinstall script so the patch is applied after every yarn install
• Add patches/@chainsafe+libp2p-yamux+7.0.4.patch at the repo root (patch-package format) and delete the old .yarn/patches/ file
• Add patches/ to the files array and a patchedDependencies field in both published packages (ocap-kernel, kernel-utils) so consumers get the patch file when they npm install either package
• Add a "SES/Lockdown Compatibility" section to both published READMEs with step-by-step patch-package instructions
• Add two new yarn constraints rules: expectNoPatchProtocolProductionDependencies (guard against re-introducing patch: URLs in published packages) and expectPatchedDependenciesAreDeclaredAndShipped (ensure every declared patch is included in files)

Testing

yarn constraints passes with no errors. The patch is verified applied by grep-ing Object.defineProperty in node_modules/@chainsafe/libp2p-yamux/dist/src/decode.js after yarn install. The constraint rules were validated by temporarily removing a patchedDependencies entry and confirming an error is reported.

🤖 Generated with Claude Code

---

Note

Medium Risk
Medium risk because it changes install-time behavior (postinstall) and how published packages manage/ship patched dependencies, which could break consumer installs if misconfigured. Also includes minor dependency bumps (@metamask/snaps-utils, @metamask/design-system-react) that may introduce compatibility changes.

Overview
Switches SES compatibility patching to patch-package. Replaces Yarn patch: dependency specs for @chainsafe/libp2p-yamux@7.0.4 with a plain version and adds patch-package to the root postinstall, while adding patch files under patches/ (and duplicating them under packages/kernel-utils/patches/ and packages/ocap-kernel/patches/).

Makes patches consumable and enforceable. @metamask/ocap-kernel and @metamask/kernel-utils now ship patches/ in their npm files and declare patchedDependencies, with README guidance for consumers; Yarn constraints now reject patch: production deps and ensure declared patch files are included in published package files.

Separately updates @metamask/snaps-utils in kernel-browser-runtime and bumps @metamask/design-system-react in kernel-ui (lockfile updated accordingly).

^{Written by Cursor Bugbot for commit 54149eb. This will update automatically on new commits. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​snaps-utils@​11.7.1 ⏵ 12.1.0	+1		+1	+2
	@​metamask/​design-system-react@​0.6.0 ⏵ 0.9.0			+1	+5
	patch-package@​8.0.1
	@​metamask/​utils@​11.9.0 ⏵ 11.10.0			+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• tmp@0.2.5
• jsonify@0.0.1
• patch-package@8.0.1
• @yarnpkg/lockfile@1.1.0
• ci-info@3.9.0
• find-yarn-workspace-root@2.0.0
• json-stable-stringify@1.3.0
• klaw-sync@6.0.0
• slash@2.0.0
• fast-xml-builder@1.0.0
• open@7.4.2
• is-wsl@2.2.0
• fs-extra@10.1.0
• is-docker@2.2.1
• @metamask/utils@11.10.0
• @metamask/snaps-utils@12.1.0
• @metamask/design-system-react@0.9.0
• @metamask/slip44@4.4.0
• @metamask/snaps-sdk@10.4.0
• fast-xml-parser@5.4.2
• @metamask/design-system-shared@0.2.0
• strnum@2.2.0

View full report

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	76.09% 🟰 ±0%	6632 / 8715
🔵	Statements	75.98% 🟰 ±0%	6738 / 8867
🔵	Functions	73.95% 🟰 ±0%	1653 / 2235
🔵	Branches	75.35% 🟰 ±0%	2468 / 3275

File Coverage

No changed files found.

Generated in workflow #3891 for commit 54149eb by the Vitest Coverage Report Action

[rekmarks]

@SocketSecurity ignore npm/patch-package@8.0.1

Capabilities are necessary. New authors are known to be or seem legit.

[rekmarks]

@SocketSecurity ignore-all

(I guess it makes sense ignoring one package doesn't also ignore its dependencies)