chore(deps): bump better-sqlite3 from 12.11.1 to 13.0.2 - #9
chore(deps): bump better-sqlite3 from 12.11.1 to 13.0.2#9dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [better-sqlite3](https://github.com/WiseLibs/better-sqlite3) from 12.11.1 to 13.0.2. - [Release notes](https://github.com/WiseLibs/better-sqlite3/releases) - [Commits](WiseLibs/better-sqlite3@v12.11.1...v13.0.2) --- updated-dependencies: - dependency-name: better-sqlite3 dependency-version: 13.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Closing — this bump can't pass, and the fix is a different version. better-sqlite3 13.0.0–13.0.2 replaced 13.0.3 is the version that actually unblocks it: prebuilds are now shipped inside the npm tarball ( |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
|
Correcting myself: the reason I gave above is wrong. I read "no prebuilts" off the GitHub release assets for 13.x, which are empty. npm doesn't install from those — it installs the tarball, and the 13.0.2 tarball carries all 8 prebuilds including
So 13.0.2 was already the fixed shape, and my "wait for 13.0.3" advice was pointless — the compile-from-source window was 13.0.0–13.0.1. What I still can't explain is why this PR's CI ran #10 is the experiment: same bump, lockfile regenerated by a real |
Re-opens what #9 closed, with a corrected reading of why #9 failed. #9 was closed on the claim that 13.0.0-13.0.2 ship no prebuilt binaries. That was wrong: it was read off the GitHub *release* assets, which are empty for 13.x, not off the npm tarball, which is what npm actually installs. Registry metadata is unambiguous: 13.0.0 / 13.0.1 scripts.install = "node-gyp rebuild" gypfile = true 13.0.2 / 13.0.3 scripts.install = absent gypfile = false and the 13.0.2 and 13.0.3 tarballs both carry all 8 prebuilds, win32-x64 included. So 13.0.2 is already the fixed shape — the compile-from-source window was 13.0.0-13.0.1 only. What that does not yet explain is why #9's CI ran `node-gyp rebuild` for 13.0.2 and died on VS 2026 detection under node 22. I could not reproduce it: `npm ci` against #9's exact package.json + lockfile on Windows, node 22, under npm 10.9.3, 10.9.8 and 11 installs 44 packages in ~2s with no compile. Five clean attempts, no repro. This PR is the experiment that settles it — same bump, but with a lockfile regenerated by a real `npm install` rather than Dependabot's metadata-only rewrite, which is the one input I could not reproduce locally. If CI is green, that difference was the cause. Fallout of the move, all consistent with the install script being gone: allowScripts drops better-sqlite3 entirely, script-lens.json records zero packages with install-time behavior, and the lockfile loses 413 lines as the prebuild-install subtree goes with it. Offline tests pass. Cooldown: 13.0.3 clears the 72h window tomorrow. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 participant
Bumps better-sqlite3 from 12.11.1 to 13.0.2.
Release notes
Sourced from better-sqlite3's releases.
... (truncated)
Commits
569e85a13.0.2df1324bfix: this dependabot configuration does not set a co... in... (#1508)b9fbe5ffixed segfault from making calls while worker thread is terminating71707c4validate the parameters of table properly (#1504)6478c99Update SQLite to version 3.53.4 (#1506)6d24034add gypfile option to package.json (#1505)ab6232efixed typo in docs57d751cupdated readme6efdbc513.0.132ee0abMerge remote-tracking branch 'origin/master'Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)