chore(deps-dev): bump @napi-rs/cli from 3.8.6 to 3.9.0 in the development group

[dependabot]

Bumps the development group with 1 update: @napi-rs/cli.

Updates @napi-rs/cli from 3.8.6 to 3.9.0

Commits

• f4cbe8d chore(release): publish
• 9c23c8c chore(deps): update dependency oxc-parser to ^0.148.0 (#3475)
• a472725 chore(napi): keep anyhow error cause when converting (#3477)
• 2d40a52 feat(cli): add explicit build module format (#3463)
• 56c1cce perf(napi): outline threadsafe callback dispatch (#3465)
• 57826b9 perf(napi): outline class instance construction (#3464)
• a80018e fix(napi): catch panics in closure trampolines instead of aborting (#3473)
• cfc2a9c perf(sys): deduplicate dynamic symbol loading (#3466)
• 9b24b06 chore(deps): update cross-platform-actions/action action to v1.5.0 (#3471)
• b494acc fix(deps): update rust crate convert_case to 0.12 (#3469)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​napi-rs/​cli@​3.8.6 ⏵ 3.9.0	+1		+1

View full report

[clawsweeper]

Codex review: needs changes before merge. Reviewed September 4, 2026, 1:29 PM ET / 17:29 UTC.

ClawSweeper review

What this changes

This PR updates the development-only @napi-rs/cli native-addon build tool from 3.8.6 to 3.9.0 and refreshes its pnpm lockfile resolution.

Merge readiness

⛔ Needs changes before merge - 2 items remain

Keep open. The update is narrow and mechanically consistent, but it needs the required Unreleased changelog entry for a native build-tool/package change before merge.

Priority: P3
Reviewed head: 3fb67276bfc7686405a9425d4b41c4561628d2bf

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	The mechanically generated two-file update is well scoped; only the required release-note documentation remains.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored development-dependency update is exempt from contributor real-behavior proof; the existing native build and package checks remain the appropriate validation.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot-authored development-dependency update is exempt from contributor real-behavior proof; the existing native build and package checks remain the appropriate validation.
Evidence reviewed	5 items	Introduced dependency update: The verified PR delta changes only the root development dependency and matching lockfile entries from 3.8.6 to 3.9.0. Dependency is an active build dependency: The private native workspace invokes the CLI’s napi build command to produce the binding. Release integration: The release matrix executes the same CLI for standard, cross-toolchain, and Zig native builds, establishing that its compatibility matters to package artifacts.
Findings	1 actionable finding	[P3] Document the native build-tool update
Security	None	None.

How this fits together

The native build workspace invokes the N-API CLI to compile fs-safe’s platform bindings. Those bindings are assembled into the published package and provide the optional native implementation behind the filesystem-safety API.

flowchart LR
  A[Native Rust source] --> B[N-API build CLI]
  B --> C[Platform native bindings]
  C --> D[Package assembly]
  D --> E[Filesystem-safe API consumers]

Loading

Before merge

• Document the native build-tool update (P3) - AGENTS.md requires an Unreleased CHANGELOG.md entry for package or operational changes. This version controls the CLI used to produce release bindings, so leaving it undocumented omits the change from the repository’s release record.
• Complete next step (P2) - Add an Unreleased CHANGELOG entry for the @napi-rs/cli 3.9.0 native build-tool update before merge.

Findings

• [P3] Document the native build-tool update — package.json:168

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain the pinned update, add a concise Unreleased changelog note for the native build CLI refresh, and rely on the existing cross-platform native and package checks before landing.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates build tooling rather than reporting a user-facing defect.

Is this the best way to solve the issue?

No: the version and lockfile update are appropriately narrow, but repository policy also requires an Unreleased changelog entry for this package/operational change.

Full review comments:

• [P3] Document the native build-tool update — package.json:168
AGENTS.md requires an Unreleased CHANGELOG.md entry for package or operational changes. This version controls the CLI used to produce release bindings, so leaving it undocumented omits the change from the repository’s release record.
  Confidence: 0.98

Overall correctness: patch is correct
Overall confidence: 0.96

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 3afa58251b49.

Labels

Label changes:

• add P3: This is a small development-tool maintenance update with no direct filesystem API or runtime behavior change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored development-dependency update is exempt from contributor real-behavior proof; the existing native build and package checks remain the appropriate validation.

Label justifications:

• P3: This is a small development-tool maintenance update with no direct filesystem API or runtime behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot-authored development-dependency update is exempt from contributor real-behavior proof; the existing native build and package checks remain the appropriate validation.

Evidence

Acceptance criteria:

• [P1] pnpm check.
• [P1] git diff --check.

What I checked:

• Introduced dependency update: The verified PR delta changes only the root development dependency and matching lockfile entries from 3.8.6 to 3.9.0. (package.json:168, 3fb67276bfc7)
• Dependency is an active build dependency: The private native workspace invokes the CLI’s napi build command to produce the binding. (native/package.json:27, 3fb67276bfc7)
• Release integration: The release matrix executes the same CLI for standard, cross-toolchain, and Zig native builds, establishing that its compatibility matters to package artifacts. (.github/workflows/release.yml:173, 3fb67276bfc7)
• Required release documentation: Repository policy requires an Unreleased CHANGELOG entry for package or operational changes; the PR does not modify CHANGELOG.md, whose current top section is the released 0.8.0 notes. (AGENTS.md:44, 3fb67276bfc7)
• Relevant package history: Recent package and changelog history includes the 0.8.0 release by Peter Steinberger and an earlier merged @napi-rs/cli update by dependabot[bot]. (package.json:168, c869df38e729)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• dependabot[bot]: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add an Unreleased CHANGELOG entry describing the @napi-rs/cli 3.9.0 native build-tool refresh.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.