chore: pin @napi-rs/wasm-runtime through a pnpm catalog

[stormslowly]

Why

@napi-rs/wasm-runtime was pinned nowhere that survived CI. napi create-npm-dirs resolves it from the registry's latest dist-tag at run time and overwrites bindings/wasm32-wasi/package.json with ^<latest>, discarding whatever is committed. So napi deps check — which regenerated the manifests and then required a frozen lockfile — broke on every upstream release, twice in the two days 1.2.0 and 1.2.1 landed, and a release published whatever range was latest at that moment rather than the version the tests ran against.

1.2.x is why that matters: it carries the stable latest dist-tag but peers on @emnapi/core: ^2.0.0-alpha.3, and @emnapi/core has no stable 2.x, so it fails to load.

What

The version is now locked in a pnpm catalog and maintained by renovate, which already groups @napi-rs/* and reads catalog entries from pnpm-workspace.yaml. Both consumers — the binding manifest and the root dev dependency — reference catalog:.

Nothing regenerates the binding manifests any more, so napi deps check is gone. release-npm.yml calls napi version, which stamps the release version into each manifest without touching dependencies; that is still needed because scripts/prepublish.mjs pins each binding in the main package's optionalDependencies to npm/package.json's version.

catalog: never reaches consumers: pnpm pack on bindings/wasm32-wasi yields a tarball reading "@napi-rs/wasm-runtime": "1.1.6", and pnpm publish -r substitutes the same way.

Split out of #288.

[coderabbitai]

📝 Walkthrough

Walkthrough

The workspace adds a pnpm catalog entry for @napi-rs/wasm-runtime version 1.1.6, and package manifests use the catalog reference. The CI workflow removes the N-API dependency check job. The npm release workflow replaces npm directory creation with pnpm napi version before generating artifacts.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the main change: pinning @napi-rs/wasm-runtime via a pnpm catalog.
Description check	✅ Passed	The description is directly related to the changeset and explains the catalog pinning and workflow updates.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/pin-wasm-runtime-catalog

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR stabilizes the workspace’s @napi-rs/wasm-runtime version by pinning it via a pnpm catalog, preventing napi create-npm-dirs from overwriting committed dependency ranges and causing CI/release drift.

Changes:

• Add a pnpm catalog entry pinning @napi-rs/wasm-runtime to 1.1.6, and update workspace consumers to use the catalog: protocol.
• Update the npm release workflow to run napi version (instead of napi create-npm-dirs) before moving artifacts.
• Remove the napi deps check CI job that regenerated manifests and then required a frozen lockfile.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pnpm-workspace.yaml	Adds a catalog pin for @napi-rs/wasm-runtime to enforce a consistent workspace version.
pnpm-lock.yaml	Records the catalog in the lockfile and updates workspace importer specifiers to catalog:.
package.json	Switches the root dev dependency on @napi-rs/wasm-runtime to catalog:.
bindings/wasm32-wasi/package.json	Switches the binding package dependency on @napi-rs/wasm-runtime to catalog:.
.github/workflows/release-npm.yml	Uses pnpm napi version instead of regenerating npm dirs before publishing artifacts.
.github/workflows/ci.yml	Removes the napi deps check job that was incompatible with keeping manifests as committed source.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codspeed-hq]

Merging this PR will improve performance by 3.18%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
✅ 11 untouched benchmarks

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
⚡	Simulation	resolver[tsconfig resolve]	5 ms	4.8 ms	+3.18%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing chore/pin-wasm-runtime-catalog (1527f6e) with main (9a600a4)}