chore: refresh all dependencies and fix wasm32-wasi build

[Brooooooklyn]

Summary

Refreshes npm, Cargo and GitHub Actions dependencies, and fixes the WASI CI build that has been failing on every open PR.

Root cause of the WASI failure

@napi-rs/cli 3.1.3  ──emits──►  --export=emnapi_thread_crashed
                                          │
emnapi 1.4.5 (pinned) ──► libemnapi-basic-mt.a  ✗ symbol NOT defined
                                          │
                                    wasm-ld: error → build fails

The CLI told wasm-ld to export emnapi_thread_crashed, but the pinned emnapi 1.4.5 static lib never defined it. Bumping the napi-rs toolchain (@napi-rs/cli 3.1.3 → 3.7.3, emnapi 1.4.5 → 1.11.2, which defines the symbol) resolves it. The newer CLI also require()s @emnapi/core at build time, so @emnapi/core + @emnapi/runtime are now declared as devDependencies.

Changes

npm devDependencies

• @napi-rs/cli ^3.1.3 → ^3.7.3
• @napi-rs/lzma ^1.4.4 → ^1.4.5
• @napi-rs/wasm-runtime ^1.0.3 → ^1.1.6
• add @emnapi/core ^1.11.2, @emnapi/runtime ^1.11.2 (required by the CLI wasi build)
• @types/node ^24 → ^26, @types/tar ^7.0.0 → ^7.0.87
• ava ^8.0.0 → ^8.0.1, chalk ^5.5.0 → ^5.6.2
• lint-staged ^17.0.0 → ^17.0.8, npm-run-all2 ^8.0.4 → ^9.0.2
• oxlint ^1.11.1 → ^1.73.0, prettier ^3.6.2 → ^3.9.5
• tar ^7.4.3 → ^7.5.20 (security), tinybench ^6.0.0 → ^6.0.2
• typescript ^6.0.0 → ^6.0.3 — stays on 6.x on purpose: TypeScript 7 (native/Go port) breaks Yarn's built-in typescript compat patch (ENOENT … lib/_tsc.js), which would break yarn install on every CI job. tsc is not in this repo's build/lint/test path.

GitHub Actions

• actions/checkout v6 → v7
• actions/cache v5 → v6
• cross-platform-actions/action v1.1.0 → v1.3.0
• wasi-sdk 27 → 33

Cargo — already floats to latest via bare-major ranges (napi 3.10.5, tar 0.4.46, flate2 1.1.9, …) and no Cargo.lock is tracked, so nothing to bump in the manifest.

Generated files — index.js, tar.wasi.cjs, tar.wasi-browser.js, wasi-worker-browser.mjs regenerated by @napi-rs/cli 3.7.3 (native-binding version checks now read 1.1.0; tar.wasi.cjs uses require.resolve() for the sub-package wasm).

Verification (local)

Check	Result
wasm32-wasip1-threads build (wasi-sdk 32 and 33)	✅ links
NAPI_RS_FORCE_WASI=1 yarn test	✅ 22/22
native build + yarn test	✅ 22/22
cargo fmt --check / cargo clippy	✅ clean
yarn lint (oxlint)	✅ clean

Note (not changed here): the lint-staged config still references eslint -c .eslintrc.yml, but the repo migrated to oxlint and neither eslint nor that config exists — the husky pre-commit hook is effectively a no-op/failure. Worth a follow-up.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 62151b540d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".