[jamesyong-42]

The napi crates are released as one family, and napi-derive's #[napi] expansion targets its own napi and napi-derive-backend. Dependabot bumps them one at a time, so #204 (napi 3.8.5 → 3.8.6 alone) has been red at CI check Build on every rebase since 2026-10-12. This PR moves the family together, in the lockfile only, and groups it in dependabot.yml so the next bump arrives as one PR. It supersedes #204.

Why #204 is red

• napi 3.8.6 depends on ctor 0.11 with default features off and no features. napi 3.8.5 asked ctor 0.10 for proc_macro.
• The lock's napi-derive 3.5.4 expands #[napi] to ctor::ctor, which is now configured out.

Measured (cargo check -p truffle-napi on main 053c473, 2026-10-27)

Lock	Errors
napi 3.8.6 alone (#204's lock)	26: error[E0433]: cannot find ctor in ctor
+ napi-derive 3.5.5 (published the same minute as 3.8.6)	86: napi-derive-backend floats to 5.1.2, whose output calls prelude functions napi 3.8 lacks (get_named_property_raw, from_raw_required_field, …)
the family together (this PR)	0, with no source change

The lock change

• napi 3.8.5 → 3.15.0
• napi-derive 3.5.4 → 3.6.13
• napi-derive-backend 5.0.3 → 6.1.6
• napi-sys 3.2.1 → 3.4.1
• napi-build 2.3.1 → 2.6.0

With them, ctor moves 0.10.0 → 1.0.13 and convert_case 0.11.0 → 0.12.0. ctor-proc-macro, dtor and dtor-proc-macro leave the lock. No Cargo.toml changes: the workspace already asks for napi = "3" and napi-derive = "3".

dependabot.yml

The cargo entry gains groups: napi: patterns: ['napi', 'napi-*'].

Tests

Run locally on this branch (88347c3, macOS arm64, pnpm 10.20.0, node 26) on 2026-10-27, as CI check runs them. Every step exited 0:

• pnpm install --frozen-lockfile --ignore-scripts
• pnpm run release:check, pnpm run lint, pnpm run format:check
• pnpm run build: napi build --platform --release compiled napi 3.15.0, napi-derive 3.6.13, napi-derive-backend 6.1.6, napi-sys 3.4.1 and ctor 1.0.13 into truffle-napi (47.7 s), and the other five packages built.
• pnpm run test: benchmark/app 312/312, plus packages/core and packages/react.
• cargo metadata --locked
• cargo deny check (0.20.2): advisories ok, bans ok, licenses ok, sources ok

The build rewrote the tracked crates/truffle-napi/index.d.ts, and it came out byte-identical: the new napi-derive emits the same type definitions.

The pinned @napi-rs/cli 3.6.2 builds the new family, so this PR does not move it.

cargo clippy -p truffle-napi -- -D warnings is red, with the same four errors on main's lock: three unsafe_code and one new_without_default, all in truffle-napi's own source. CI's clippy excludes truffle-napi, and this PR does not change that.

Open

Why Dependabot proposes napi 3.8.6 rather than 3.15.0 is unexplained. It is not the MSRV: every version involved declares 1.88.

The Dependabot integration red (not this PR)

#204's Integration job failed for a separate reason: the Dependabot copy of TRUFFLE_TEST_AUTHKEY had been stale since the Actions secret was rotated on 2026-10-20. Every Dependabot integration run was red from 2026-10-20 22:00Z, waiting out authentication. The Dependabot copy was reset on 2026-10-27 at 17:05Z. This PR's own Integration run reads the Actions secret.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}