[dependabot]

Bumps @emnapi/runtime from 2.0.0-beta.1 to 2.0.0-beta.2.

Release notes

Sourced from @​emnapi/runtime's releases.

v2.0.0-beta.2

What's Changed

• fix: keep copies of resizable and growable buffers inside their wasm block by @​Brooooooklyn in toyobayashi/emnapi#242
• fix: do not copy the wasm memory when memory.buffer changes mid-call by @​Brooooooklyn in toyobayashi/emnapi#243

Full Changelog: toyobayashi/emnapi@v2.0.0-beta.1...v2.0.0-beta.2

Commits

• 5afb658 2.0.0-beta.2
• 7e9e0dc fix: do not copy the wasm memory when memory.buffer changes mid-call (#243)
• 314b7b8 fix: keep copies of resizable and growable buffers inside their wasm block (#...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates @emnapi/runtime from 2.0.0-beta.1 to 2.0.0-beta.2 and refreshes its lockfile references.

Example: A contributor installs the repository's development dependencies.

• Before: The direct @emnapi/runtime dependency resolves to 2.0.0-beta.1.
• After: The direct dependency and @napi-rs/cli optional dependency reference resolve to 2.0.0-beta.2.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and consistent; confidence rests on source review and partially completed CI rather than exercised behavior.
Proof confidence	🦐 gold shrimp (3/6)	This bot-authored dependency refresh is outside the ordinary contributor proof gate; CI supports validation but does not demonstrate the upstream buffer scenarios.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The development toolchain remains pinned to the previous runtime prerelease.
Reason: This continues an established dependency-maintenance path with a narrowly scoped, internally consistent update.

Merge readiness

✅ Ready for maintainer review

Keep open: current main still uses beta.1, and this PR consistently updates the existing development dependency without an identified correctness defect.

Priority: P3
Reviewed head: 67dd3cef84ea44a9a77b9273b0c65222f99b0fbb

Before merge

None.

Findings

None.

Agent review details

How this fits together

The dependency supplies an existing runtime peer in the development toolchain; package.json selects its version and pnpm-lock.yaml records resolution and dependency relationships.

flowchart LR
  Manifest[Development dependency pin] --> Install[pnpm resolution]
  Lock[Lockfile integrity and snapshots] --> Install
  Install --> Runtime[emnapi runtime beta 2]
  Runtime --> CLI[napi rs development tooling]

Loading

Technical review

Best possible solution:

Retain the focused dependency update with consistent manifest and lockfile references.

Do we have a high-confidence way to reproduce the issue?

No fs-safe bug reproduction is claimed; source inspection verifies the dependency-resolution change.

Is this the best way to solve the issue?

The existing pin and generated lockfile are the appropriate owners for this update, without additional production code or configuration.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5147654024a7.

Provenance checked

• Direct runtime pin keeps the original intent (0e0c90c: Supply the runtime peer required by @napi-rs/cli after Vite stopped supplying it transitively.)
• Beta.1 manifest and lockfile selection keeps the original intent (62d127e: The previous merged dependency update selected beta.1; this PR preserves the same dependency relationships while advancing its version.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Introduced change and current main: The pinned diff changes only the runtime version, integrity, and corresponding lockfile references; current main retains beta.1. (package.json:196, 67dd3cef84ea)
• Existing dependency purpose: chore(deps): update Vite toolchain #124 introduced the direct runtime pin to supply @napi-rs/cli's runtime peer after Vite stopped supplying it transitively. (package.json:196, 0e0c90c05120)
• Previous update and related-item search: chore(deps-dev): bump @emnapi/runtime from 2.0.0-alpha.6 to 2.0.0-beta.1 #988 merged the beta.1 update; repository searches found no separate beta.2 implementation owning this change. (package.json:196, 62d127e2b659)
• Dependency contract and release scope: The changed lockfile installs this repository's runtime package, establishing the dependency connection; its upstream comparison changes packages/runtime/package.json's version while the advertised buffer fixes occur in other emnapi source areas, so those fixes are not established fs-safe behavior changes. (packages/runtime/package.json:3, 5afb65887f64)
• Discussion and validation state: The comments contain review-status automation and no behavioral proof or owner direction; the latest inspected checks had 48 successes, five skips, six running checks, and no failures. (67dd3cef84ea)
• Repository policy and checkout integrity: Root policy applies to both changed files, excludes routine dependency refreshes from changelog requirements, and was applied subject to the read-only review instructions; diff whitespace checks passed and the checkout remained clean. (AGENTS.md, 67dd3cef84ea)

Likely related people:

• Peter Steinberger: Raw commit eca24b4 adds package.json:187 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: eca24b4f32bb; files: package.json)

Labels

Label changes:

• add P3: This is a routine development dependency refresh with no demonstrated user-facing regression or urgent security fix.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is a routine development dependency refresh with no demonstrated user-facing regression or urgent security fix.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 1:39 PM ET / 17:39 UTC.

[steipete]

Consolidated into #1015, including the required Vitest 5.0.5 test-gating adaptation. The combined update has passed the full check and cross-platform CI. Thanks for the update.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.