chore: bump napi from 3.8.3 to 3.8.5 by dependabot[bot] · Pull Request #58 · stella/aho-corasick

dependabot · 2026-04-25T07:03:08Z

Bumps napi from 3.8.3 to 3.8.5.

Release notes

napi-v3.8.5

Fixed

(napi) preserve generator class methods (#3231)

(deps) update rust crate ctor to v0.10.0 (#3224)

(deps) disable ctor priority feature (#3209)

(deps) update rust crate ctor to v0.9.1 (#3204)

(napi) handle ThreadsafeFunction callback errors gracefully during shutdown (#3188)

(napi) populate Error::cause from ThreadsafeFunction callee-handled callbacks (#3162)

correct typo in Either error message ("non" → "none") (#3183)

napi-v3.8.4

Fixed

(deps) update rust crate ctor to v0.8.0 (#3170)

(deps) update rust crate ctor to v0.7.0 (#3169)

(napi) check for null error_message in ExtendedErrorInfo::try_from (#3158)

(napi) skip nullish error causes when converting from Unknown (#3143)

Commits

78eb068 chore: release (#3184)
490f7d5 build(deps): bump follow-redirects from 1.15.11 to 1.16.0 (#3237)
d5c3c43 chore(release): publish
d1e5b17 fix(cli): include napi9 in interactive new prompt (#3235)
0cb8eef fix(wasm-runtime): preserve full bigint values in fs proxy codec (#3233)
44aa08f fix(napi): preserve generator class methods (#3231)
bdc492a chore(deps): update dependency oxc-parser to ^0.125.0 (#3230)
daabe32 fix(cli): use target cwd for pre-publish git log lookup (#3228)
23abb8a fix(cli): remove stale browser metadata in non-WASI new projects (#3229)
ce170eb fix(cli): apply enableTypeDef when generating new projects (#3214)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [napi](https://github.com/napi-rs/napi-rs) from 3.8.3 to 3.8.5. - [Release notes](https://github.com/napi-rs/napi-rs/releases) - [Commits](napi-rs/napi-rs@napi-v3.8.3...napi-v3.8.5) --- updated-dependencies: - dependency-name: napi dependency-version: 3.8.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

devin-ai-integration

Devin Review found 3 potential issues.

devin-ai-integration · 2026-04-25T07:06:00Z

📝 Info: napi-derive@3.5.2 still depends on older ctor@0.6.3 — this is expected

In the dependencies graph at provenance/sbom.cdx.json:2396-2404, napi-derive@3.5.2 still lists pkg:cargo/ctor@0.6.3 as a dependency. This is correct per the Cargo.lock — napi-derive uses the older ctor while napi@3.8.5 uses the newer ctor@0.10.1. Both versions legitimately coexist in the dependency tree. The issue is only that the SBOM's dependencies array is missing resolution entries for the old versions (reported as BUG-0001), not that the reference itself is wrong.

(Refers to lines 2396-2404)

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-04-25T07:06:01Z

+        "pkg:cargo/ctor-proc-macro@0.0.13",
+        "pkg:cargo/dtor@0.8.1"
      ],
-      "ref": "pkg:cargo/ctor@0.6.3"
+      "ref": "pkg:cargo/ctor@0.10.1"
    },
    {
      "dependsOn": [],
-      "ref": "pkg:cargo/ctor-proc-macro@0.0.7"
+      "ref": "pkg:cargo/ctor-proc-macro@0.0.13"
    },
    {
      "dependsOn": [
-        "pkg:cargo/dtor-proc-macro@0.0.6"
+        "pkg:cargo/dtor-proc-macro@0.0.13"
      ],
-      "ref": "pkg:cargo/dtor@0.1.1"
+      "ref": "pkg:cargo/dtor@0.8.1"
    },
    {
      "dependsOn": [],
-      "ref": "pkg:cargo/dtor-proc-macro@0.0.6"
+      "ref": "pkg:cargo/dtor-proc-macro@0.0.13"


🟡 SBOM dependencies entries for old package versions were replaced instead of augmented, leaving orphaned components

The dependencies array in the SBOM had its entries for ctor@0.6.3, ctor-proc-macro@0.0.7, dtor@0.1.1, and dtor-proc-macro@0.0.6 replaced by entries for the new versions (ctor@0.10.1, etc.) rather than having the new entries added alongside them. However, the components array still contains both old and new versions, and napi-derive@3.5.2 still references pkg:cargo/ctor@0.6.3 at provenance/sbom.cdx.json:2398. The Cargo.lock confirms both version sets are legitimate dependencies. This makes the SBOM internally inconsistent: 4 components have no corresponding ref in the dependencies array, and a dependency edge points to a component (ctor@0.6.3) with no resolved sub-dependencies.

Prompt for agents

The dependencies array in provenance/sbom.cdx.json replaced the old-version entries (ctor@0.6.3, ctor-proc-macro@0.0.7, dtor@0.1.1, dtor-proc-macro@0.0.6) with new-version entries (ctor@0.10.1, ctor-proc-macro@0.0.13, dtor@0.8.1, dtor-proc-macro@0.0.13) instead of adding the new entries alongside the old ones. Since the components array correctly lists both old and new versions, and napi-derive@3.5.2 at line 2398 still references ctor@0.6.3, the dependencies array needs entries for BOTH sets. Add back the missing dependency ref entries for the 4 old-version packages (matching the Cargo.lock data at lines 35-95), alongside the existing new-version entries. This is likely a bug in how the provenance tool was run — regenerating the SBOM with the correct tool invocation should produce the correct output.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-04-25T07:06:02Z

      "sbom": "sbom.cdx.json",
      "notice": "THIRD-PARTY-NOTICES.txt",
-      "dependencies_with_licenses": 43
+      "dependencies_with_licenses": 47


📝 Info: Dependency count in report.json is consistent with added components

The dependencies_with_licenses field was updated from 43 to 47 (provenance/report.json:14), which correctly accounts for the 4 new component versions added: ctor@0.10.1, ctor-proc-macro@0.0.13, dtor@0.8.1, and dtor-proc-macro@0.0.13. This matches the additions in both the THIRD-PARTY-NOTICES.txt and the sbom.cdx.json components array.

Was this helpful? React with 👍 or 👎 to provide feedback.

dependabot · 2026-05-09T07:03:14Z

A newer version of napi exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

jan-kubica · 2026-06-02T21:19:18Z

Closing as superseded by the consolidated dependency update merged in #76.

CC on behalf of @jan-kubica

dependabot · 2026-06-02T21:19:22Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added the 📦 dependencies label Apr 25, 2026

chore: refresh provenance artifacts

4168e94

devin-ai-integration Bot reviewed Apr 25, 2026

View reviewed changes

jan-kubica closed this Jun 2, 2026

dependabot Bot deleted the dependabot/cargo/napi-3.8.5 branch June 2, 2026 21:19

Navigation Menu

Uh oh!

chore: bump napi from 3.8.3 to 3.8.5 - #58

chore: bump napi from 3.8.3 to 3.8.5#58
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/cargo/napi-3.8.5

dependabot Bot commented on behalf of github Apr 25, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Apr 25, 2026

Uh oh!

devin-ai-integration Bot Apr 25, 2026

Uh oh!

devin-ai-integration Bot Apr 25, 2026

Uh oh!

dependabot Bot commented on behalf of github May 9, 2026

Uh oh!

jan-kubica commented Jun 2, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

napi-v3.8.5

Fixed

napi-v3.8.4

Fixed

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github May 9, 2026

Uh oh!

jan-kubica commented Jun 2, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Apr 25, 2026 •

edited

Loading