fix(yarn-project): restore noir packages to beta.21 in yarn.lock

[AztecBot]

Problem

CI on merge-train/spartan-v5 is failing at the yarn-project build step (log: http://ci.aztec-labs.com/1780602815190408). The yarn install --immutable step aborts with:

YN0028: The lockfile would have been modified by this install, which is explicitly forbidden.

Root cause

The head commit on the train, #23827 (feat!: proofless tx lookup in getTxByHash and getTxsByHash), accidentally bumped the @aztec/noir-* package versions in yarn-project/yarn.lock from 1.0.0-beta.21 → 1.0.0-beta.22 (versions, resolution hashes, and checksums). That change is unrelated to the PR's actual content (all other touched files are .ts/docs).

The noir packages on this branch are still beta.21 — confirmed at the source: the noir submodule (f1a4575) declares 1.0.0-beta.21 in .release-please-manifest.json and in every package's package.json (acvm_js, noir_js, noir_js_types, …). So yarn install --immutable resolves beta.21 from the file:/portal: packages, finds beta.22 pinned in the lockfile, and refuses to proceed. The CI resolver's own output confirms it wanted to rewrite the lockfile back to beta.21.

Fix

Restore the noir entries in yarn-project/yarn.lock to beta.21, matching the actual noir packages on the branch (identical to commit 107b336~1, the train state before #23827 was squashed in). This is the only change; the diff is limited to the spurious noir version/hash/checksum lines.

Verification

• Confirmed the noir submodule at the branch's pinned commit declares beta.21 everywhere — the lockfile now matches ground truth, so yarn install --immutable will compute zero changes.
• The pre-feat!: proofless tx lookup in getTxByHash and getTxsByHash #23827 train state (with the same beta.21 lockfile) passed CI.
• A full local ./bootstrap.sh ci could not be run in this environment (missing Rust/cargo toolchain — not the CI build-image — and the host disk is at 94%). The fix is a deterministic lockfile alignment, verified against the noir package sources rather than a full rebuild.

---

Created by claudebox · group: slackbot

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​aztec/​noir-noir_js@​1.0.0-beta.22 ⏵ 1.0.0-beta.21

View full report

[AztecBot]

Automatically closing this stale claudebox draft PR (no updates for 5+ days). Re-open if still needed.