[aversini]

Summary

Bumps better-sqlite3 12.11.1 → 13.0.1 in @node-cli/bundlecheck, the only package that depends on it.

Despite the major bump, no code changes are required. v13 rewrites the native layer on top of N-API and ships prebuilt binaries inside the tarball, replacing the deprecated prebuild-install download step. The JS API only gained methods (db.explain(), preparedStatement.toString()); nothing was removed or changed. The major is driven by the ABI/packaging rewrite and by engines.node tightening from 20.x || 22.x || … to >=22 — which every package in this repo already declares as of #603.

Verification

• tsc + swc build clean against @types/better-sqlite3@7.6.13 (still latest; v12's typed surface is a subset of v13's).
• pnpm test in packages/bundlecheck: 268/268 pass. Full monorepo: 12/12 projects pass.
• pnpm lint: clean.
• Cache compatibility: an existing ~/.bundlecheck/cache.db written by v12 (WAL mode, 35 rows) opens and reads correctly under v13 — no cache invalidation, no migration needed.
• E2E on the built CLI: cold --force run (cache write), warm run (cache hit), and --trend 3 (multi-version) all produce correct output.

src/cache.ts is the sole consumer. It uses new Database(), .pragma(), .exec(), .prepare<T>(), .get(), .run() and .close() — all unchanged — and only ever binds primitives, so the stricter parameter binding introduced in 13.0.0 (and relaxed in 13.0.1) does not apply.

Tradeoffs

Wins

• Drops 19 transitive dependencies (prebuild-install, bindings, node-abi, tar-fs, rc, tunnel-agent, simple-get, …) in favor of a single node-addon-api. Notably prebuild-install@7.1.3 is npm-deprecated as "No longer maintained."
• No network fetch at install time — prebuilds ship in the tarball, so installs no longer break behind a proxy or during a GitHub outage.
• --ignore-scripts installs now work (verified: v12 throws Could not locate the bindings file, v13 works).

Costs

• Tarball grows 2.5 MB → 10.9 MB (27 MB unpacked), since all 8 platform prebuilds ship in every install. This is the one user-visible downside for npx users.
• node-gyp still runs on install (npm auto-injects it because binding.gyp is present), so Python + make are still needed at install time. It is a no-op — binding.gyp short-circuits to TOUCH …stamp when a prebuild exists, no compilation happens.

pnpm-workspace.yaml needs no change: allowBuilds: better-sqlite3: true is already set and the build is now a no-op. Setting it to false would skip node-gyp entirely and still work, but would also remove the compile-from-source fallback for platforms outside the 8 prebuilds (win32-ia32, freebsd, linux-armv7), so it is intentionally left as-is.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KPs55pyFkC3ejzdR9JiH8r