ci(renovate): pin the napi-rs toolchain and hold flate2

.github/workflows/ci.yml

@@ -107,15 +107,27 @@ jobs:
         run: |
           # Pushes to develop always run the full matrix. Pull requests run it
           # only when something that ends up in the native binary or in the
-          # release packaging changed; JS-only or lockfile-only PRs build and
-          # test on Linux alone.
+          # release packaging changed; JS-only PRs and most dependency updates
+          # build and test on Linux alone.
           native=true
           if [ "$EVENT_NAME" = "pull_request" ]; then
             git fetch --no-tags --depth=1 origin "$BASE_SHA"
             if ! git diff --name-only "$BASE_SHA" "$HEAD_SHA" \
               | grep -qE '^(crates/|npm/|scripts/|\.cargo/|Cargo\.toml$|Cargo\.lock$|rust-toolchain|\.github/workflows/(ci|release)\.yml$)'; then
               native=false
             fi
+            # The napi-rs toolchain (@napi-rs/cli and the @napi-rs packages it
+            # uses) builds and packages every binary, so a changed line that
+            # names napi in the npm manifest, lockfile or workspace file counts
+            # as native too. Other dependency updates in those files stay on
+            # Linux; develop runs the full matrix once they are merged. The
+            # diff is captured before grep -q reads it: grep -q stops at the
+            # first match, and under pipefail the git diff it cut off would
+            # turn that match into a miss.
+            manifest_diff=$(git diff -U0 "$BASE_SHA" "$HEAD_SHA" -- package.json pnpm-lock.yaml pnpm-workspace.yaml)
+            if grep -qE '^[-+].*\bnapi\b' <<< "$manifest_diff"; then
+              native=true
+            fi
           fi
           echo "native=$native" >> "$GITHUB_OUTPUT"
           if [ "$native" = "true" ]; then

package.json

@@ -144,7 +144,7 @@
     "@codspeed/vitest-plugin": "^5.5.0",
     "@commitlint/cli": "^21.0.2",
     "@commitlint/config-conventional": "^21.0.2",
-    "@napi-rs/cli": "^3.7.1",
+    "@napi-rs/cli": "3.9.1",
     "@playwright/test": "^1.60.0",
     "@types/node": "^24.13.2",
     "@vitest/coverage-v8": "^4.1.8",

renovate.json

@@ -8,7 +8,11 @@
   "prHourlyLimit": 0,
   "rebaseWhen": "conflicted",
   "lockFileMaintenance": {
-    "enabled": false
+    "description": "Refresh the lock files once a month, for review. Renovate runs weekly, so the first seven days of a month hold exactly one run. Cargo.lock gets its own PR through the rust-dependencies group. A refresh has no release timestamp, so minimumReleaseAge would hold it forever",
+    "enabled": true,
+    "schedule": ["* * 1-7 * *"],
+    "minimumReleaseAge": null,
+    "automerge": false
   },
   "packageRules": [
     {
@@ -19,13 +23,14 @@
       "automerge": true
     },
     {
-      "description": "Pin GitHub Actions digests; group and automerge non-major updates",
+      "description": "Pin GitHub Actions digests; group and automerge non-major updates, digests included, once they are 3 days old: a retargeted tag is how the tj-actions/changed-files compromise spread. A digest update is aged by the release its tag resolves to but carries no timestamp of its own, which must not hold it forever",
       "matchManagers": ["github-actions"],
       "matchUpdateTypes": ["minor", "patch", "digest"],
       "groupName": "github-actions (non-major)",
       "pinDigests": true,
       "automerge": true,
-      "minimumReleaseAge": "0 days"
+      "minimumReleaseAge": "3 days",
+      "minimumReleaseAgeBehaviour": "timestamp-optional"
     },
     {
       "description": "Group Rust crate updates",
@@ -37,6 +42,24 @@
       "matchManagers": ["cargo"],
       "matchUpdateTypes": ["minor", "patch"],
       "automerge": true
+    },
+    {
+      "description": "napi-rs toolchain: the CLI and the napi crates build and package every binary, so they update together and are reviewed, never automerged (#518, #526, #529). Keep this rule after the generic ones, as later rules win",
+      "matchPackageNames": ["@napi-rs/*", "napi", "napi-derive", "napi-build"],
+      "groupName": "napi-rs toolchain",
+      "automerge": false
+    },
+    {
+      "description": "Keep the napi-rs packages at exact versions in package.json, so a toolchain update shows in the reviewed diff and not only in pnpm-lock.yaml",
+      "matchManagers": ["npm"],
+      "matchPackageNames": ["@napi-rs/*"],
+      "rangeStrategy": "pin"
+    },
+    {
+      "description": "Respect the flate2 =1.1.9 pin in Cargo.toml: 1.1.10 makes gzip/deflate much slower with zlib-rs (#509)",
+      "matchManagers": ["cargo"],
+      "matchPackageNames": ["flate2"],
+      "allowedVersions": "<=1.1.9"
     }
   ]
 }