# Temporary dependency patches

Keep existing insertion anchors when extending these patches: pnpm 12 can apply a zero-context, zero-length insertion one line early. After regeneration and installation, verify installed files against the patch's target blob hashes before testing.

`@novnc/novnc@1.7.0` has an approved temporary patch for ignored extended-clipboard payloads. The RFB owner consumes the remaining compressed bytes before returning for view-only clients or unsupported clipboard formats. It does not inflate or publish ignored clipboard data, and controlling text clipboard handling stays unchanged. This keeps clipboard bytes from becoming the next RFB message and disconnecting WebVNC.

Remove the noVNC patch, its registration, and its exact-version guard exception when an upstream version passes the Desktop panel and document browser suites (`test/vitest/vitest.ui-e2e.config.ts`) and the live view-only selection/type stress check. The regression uses the real noVNC parser, covers coalesced and fragmented payload delivery, and requires the next framebuffer update without a reconnect.

`matrix-js-sdk@42.2.0` has an approved temporary patch for saved-sync verification replay. Classic sync propagates its existing cache provenance through ordinary client events, and the crypto listener ignores restored events. This preserves room history, sync cursors, ordinary event listeners, fresh verification events, and to-device processing while preventing cached verification requests from restarting after a clean client shutdown.

Remove the Matrix patch, its registration, and its exact-version guard exception when an upstream release passes `node scripts/run-vitest.mjs extensions/matrix/src/matrix/client/file-sync-store.sdk.test.ts` and the full Matrix QA catalog, including the original DM SAS-to-QR sequence. The regression exercises the real SQLite sync store, SDK cache hydration, and crypto event wiring; it observes crypto input rather than substituting for native verification proof.

`@vitest/runner@4.1.11` has an approved temporary pnpm patch for lost trailing task updates. It accepts the exact batching deadline and clears the consumed timer handle before re-entering the throttle, allowing an early callback to rearm. The 100 ms batching interval and immediate-call cancellation stay unchanged; this is not a maintained fork or a reporting SLA.

Remove the runner patch, its registration, and its exact-version guard exception when upgrading to an upstream fixed version with `test/scripts/vitest-runner-task-updates.test.ts` green. Keep that regression to verify completion delivery without later task events or file-finalization rescue. Generate and register patches through pnpm; never edit installed dependency files manually.

`vitest@4.1.11` has an approved temporary patch for graceful fork shutdown. The built-in forks/vmForks transport marks its stopped response with `willExit`, flushes it, and explicitly exits; its parent joins actual exit through the worker's exit observer within the existing 60-second stop deadline, before computing the run result. Custom fork entrypoints that omit this fact retain parent-owned termination; they can explicitly opt in with the response and observer contract. This lets exit cleanup and native CPU/heap profiles finish without racing SIGTERM or its 500 ms escalation. Timeout and abnormal-exit paths still report failure and terminate/join the worker; forced termination retains the existing signal deadline. Threads retain their existing stop protocol. No OpenClaw setup or profiling option changes are needed.

The same exact-version patch also restores native CLI validation in public `parseCLI`: after parsing without execution, it runs CAC's existing unknown-option, required-value, and required-argument checks. Help/version retain their native validation bypass, repeated-option transforms stay unchanged, and `allowUnknownOptions` still controls unknown-option rejection. No option catalog is copied and no command or config executes during parsing.

Remove this patch, its registration, and its exact-version guard exception when an upstream version passes `node scripts/run-vitest.mjs test/scripts/vitest-fork-shutdown.test.ts test/scripts/run-vitest-state-cleanup.test.ts test/scripts/run-vitest-profile.test.ts`. The regressions cover slow exit cleanup, delayed stop-response delivery during natural exit, custom entrypoint compatibility/opt-in, vmForks, abnormal exits, and bounded hung/forced cleanup with actual installed workers and native profile artifacts. The stop-deadline test clock advances the existing deadline only after the worker reaches its shutdown boundary; it does not change production timeouts.