fix: use correct JSR specifier for @meshtastic/protobufs

[danditomaso]

Summary

• Fix the @meshtastic/protobufs dependency specifier to use the full JSR format (jsr:@meshtastic/protobufs@^2.7.18) instead of the shorthand
• Pin pnpm version to 10.17.0 in CI workflows for reproducible builds
• Remove unused .npmrc (JSR registry config no longer needed with correct specifier)

Test plan

• Verify pnpm install resolves correctly
• Verify CI builds pass with pinned pnpm version

[vercel]

@danditomaso is attempting to deploy a commit to the Meshtastic Team on Vercel.

A member of the Team first needs to authorize it.

[Copilot]

Pull request overview

Updates the repo’s dependency and CI configuration to correctly consume @meshtastic/protobufs from JSR and make pnpm installs more reproducible in CI.

Changes:

• Fix @meshtastic/protobufs to use the full JSR specifier format (jsr:@meshtastic/protobufs@^2.7.18).
• Pin pnpm to 10.17.0 in PR and main-branch CI workflows.
• Remove the root .npmrc JSR registry override.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

File	Description
package.json	Corrects the JSR dependency specifier for @meshtastic/protobufs.
.npmrc	Removes the JSR registry config entry now deemed unnecessary.
.github/workflows/pr.yml	Pins pnpm version to 10.17.0 for PR CI reproducibility.
.github/workflows/ci.yml	Pins pnpm version to 10.17.0 for main branch CI reproducibility.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[reillylm]

@danditomaso looking at the build logs, seems like pnpm is trying to get the package from the wrong URL:

GET https://npm.jsr.io/@jsr/meshtastic__protobufs/-/meshtastic__protobufs-2.7.18.tgz: 

when it should look more like (I got this from looking up other repos using the package):

https://npm.jsr.io/~/11/@jsr/meshtastic__protobufs/2.7.18.tgz

Looks like there's a recent issue with pnpm where it removes the URL from the lockfile if it's from a custom registry (pnpm/pnpm#10915). I wonder if you're on that problematic version on your local machine? Looking at the diffs in this branch, looks like the JSR URL was never in there, so maybe we were able to get away with the URL missing from the lockfile because we had the custom registry specified in the .npmrc? Not sure.

Either way, I updated my local pnpm to 10.32.0 (the latest version mentioned in the issue with the lockfile URL fix) and removed + reinstalled the package so it would repopulate the URL on the lockfile:

pnpm uninstall @meshtastic/protobufs
pnpm add jsr:@meshtastic/protobufs@^2.7.20

Then I tried it out by deleting node_modules, clearing my pnpm cache + store, and reverting my pnpm version to 10.17.0 (what we're using in the CI build in this branch), and the install succeeded. So it seems like that will work in the CI build 🙂

[reillylm]

Here's the diff/patch for that change. I used corepack to switch between pnpm versions, which is why the packageManager field is in there-- it's set to the latest pnpm version (with the URL fix):

patch

diff --git a/package.json b/package.json
index ec694027..3d312164 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,7 @@
   },
   "dependencies": {
     "@bufbuild/protobuf": "^2.9.0",
-    "@meshtastic/protobufs": "jsr:@meshtastic/protobufs@^2.7.20",
+    "@meshtastic/protobufs": "jsr:^2.7.20",
     "ste-simple-events": "^3.0.11",
     "tslog": "^4.9.3"
   },
@@ -55,5 +55,6 @@
       "core-js",
       "esbuild"
     ]
-  }
+  },
+  "packageManager": "pnpm@10.32.1+sha512.a706938f0e89ac1456b6563eab4edf1d1faf3368d1191fc5c59790e96dc918e4456ab2e67d613de1043d2e8c81f87303e6b40d4ffeca9df15ef1ad567348f2be"
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 369dc25a..f27358f8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -12,7 +12,7 @@ importers:
         specifier: ^2.9.0
         version: 2.11.0
       '@meshtastic/protobufs':
-        specifier: jsr:@meshtastic/protobufs@^2.7.20
+        specifier: jsr:^2.7.20
         version: '@jsr/meshtastic__protobufs@2.7.20'
       ste-simple-events:
         specifier: ^3.0.11
@@ -1223,7 +1223,7 @@ packages:
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
   '@jsr/meshtastic__protobufs@2.7.20':
-    resolution: {integrity: sha512-GrHWfOzi9i7xk2Br3MkKWLxbzreZuwgjZKNooednYpa1V/abnSj9e4twNTtKyqXYaAOzthY3Cdk4IXouBN9dbA==}
+    resolution: {integrity: sha512-GrHWfOzi9i7xk2Br3MkKWLxbzreZuwgjZKNooednYpa1V/abnSj9e4twNTtKyqXYaAOzthY3Cdk4IXouBN9dbA==, tarball: https://npm.jsr.io/~/11/@jsr/meshtastic__protobufs/2.7.20.tgz}
 
   '@mapbox/geojson-rewind@0.5.2':
     resolution: {integrity: sha512-tJaT+RbYGJYStt7wI3cq4Nl4SXxG8W7JDG5DMJu97V25RnbNg3QtQtf+KD+VLjNpWKYsRvXDNmNrBgEETr1ifA==}

[danditomaso]

Here's the diff/patch for that change. I used corepack to switch between pnpm versions, which is why the packageManager field is in there-- it's set to the latest pnpm version (with the URL fix):

patch

Thanks for this, I do really appreciate the help. It looks like that didn't fix the issue, you can see my latest couple of commits and how they haven't fixed the issue yet. I'm still back at square one with this.

[reillylm]

@danditomaso I think, in your latest commits, the JSR URL is still missing in the lockfile. I added a commit to try that out in #1032, that should automatically trigger a CI build right?

edit: wanted to mention, the URL got added automatically when I did the remove/add of the dependency (I didn't manually edit the file). Are you sure you were running the latest version of pnpm when you did that procedure?

I think, in order to have corepack pick up on the pnpm version from the package.json -> packageManager, you have to run corepack enable. For me, I had to remove my previous version of pnpm from my global node_modules directory so the PATH would point to the corepack-installed version of it (I had previously installed pnpm with npm i -g pnpm). When I did corepack use pnpm@latest, it automatically added the packageManager entry with the SHA hash.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web-test	Ready	Preview, Comment	Mar 17, 2026 1:09am