chore(deps): apply safe dependency updates

.github/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
       node-version: "24.20.0"
       install-policy: "blocked"
       build-command: bun run build
-      wrangler-version: "4.136.3"
+      wrangler-version: "4.145.0"
       environment: production
       concurrency-group: deploy-worker-production
       timeout-minutes: 15

.husky/pre-commit

@@ -22,6 +22,9 @@ trap "exit 143" TERM
 trap "exit 129" HUP
 
 snapshot=$(mktemp -d "${TMPDIR:-/tmp}/basalt-index-XXXXXX")
+physical_snapshot=$(cd "$snapshot" && pwd -P)
+snapshot=$physical_snapshot
+mkdir -p "$snapshot/.cache"
 
 # G2a: gitleaks reads the real commit index; keep Git's hook env until after it.
 gitleaks protect --staged --no-banner

Retrospective.md

@@ -45,3 +45,17 @@ Routing: narrative stays here. A project-specific rule that will recur may becom
 - **What:** Cloudflare Workers Builds `started_at` and `completed_at` are the same instant.
 - **Why:** GitHub check-run timestamps are when the result is written back, not the build window.
 - **Follow-up:** none (read the build log).
+
+## 2026-10-02: SWC native cache and dependency pin proof
+
+- **What:** The SWC patch upgrade initially failed its normal staged-index hook because the native loader rejected the macOS temporary cache path through `/var`. After using an owned canonical cache, the full suite exposed a test still asserting the old SWC pin.
+- **Fix:** Use a per-run canonical native cache and temporary directory without weakening the hook, and update the exact version assertion to the requested pin.
+- **Follow-up:** Search dependency-version contracts before upgrades. Keep native-loader path validation and exact dependency assertions enabled.
+
+- **Permanent correction:** The hook now canonicalizes its newly created snapshot directory and creates the owned XDG cache before native tools run. All existing staged-source, static, coverage and secret checks remain unchanged; the next commit validates the default macOS temporary environment without the run-local SWC cache override.
+
+## 2026-10-02: npm pack JSON package container
+
+- **What:** The package gate reported every file missing although the real npm12 dry-run listed the complete artifact.
+- **Why:** The parser sliced braces and assumed the artifact itself was the JSON root; npm now groups artifacts by package name.
+- **Fix:** Parse the complete JSON container, require exactly one artifact with the expected name/version, then retain every existing file/export/hash check. The real local package check passed after the correction.

biome.json

@@ -1,5 +1,5 @@
 {
-	"$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
+	"$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
 	"assist": { "actions": { "source": { "organizeImports": "on" } } },
 	"linter": {
 		"enabled": true,

package.json

@@ -68,7 +68,7 @@
 		"cmdk": "^1.1.1",
 		"i18next": "26.4.2",
 		"i18next-browser-languagedetector": "^8.2.1",
-		"lucide-react": "1.47.0",
+		"lucide-react": "1.49.0",
 		"postcss": "8.5.28",
 		"react": "19.3.0",
 		"react-dom": "19.3.0",
@@ -79,33 +79,33 @@
 		"tailwind-merge": "3.7.0"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "2.5.14",
-		"@swc/core": "1.16.2",
+		"@biomejs/biome": "2.5.15",
+		"@swc/core": "1.16.13",
 		"@tailwindcss/vite": "4.3.3",
 		"@testing-library/dom": "10.4.2",
 		"@testing-library/jest-dom": "7.0.1",
 		"@testing-library/react": "16.3.3",
-		"@types/node": "26.6.2",
+		"@types/node": "26.6.3",
 		"@types/react": "19.3.0",
 		"@types/react-dom": "19.3.0",
 		"@vitejs/plugin-react-swc": "4.3.3",
-		"@vitest/coverage-v8": "5.0.1",
+		"@vitest/coverage-v8": "5.0.3",
 		"husky": "^9.1.7",
 		"jsdom": "30.1.1",
 		"playwright": "1.63.0",
 		"publint": "0.3.24",
 		"tailwindcss": "4.3.3",
 		"typescript": "7.0.2",
 		"typescript-api": "npm:[email protected]",
-		"vite": "8.3.0",
-		"vitest": "5.0.1",
-		"wrangler": "4.136.3"
+		"vite": "8.3.1",
+		"vitest": "5.0.3",
+		"wrangler": "4.145.0"
 	},
 	"overrides": {
 		"nanoid": "3.3.18",
 		"postcss": "8.5.28",
 		"sharp": "0.35.4",
-		"vite": "8.3.0"
+		"vite": "$vite"
 	},
 	"lint-staged": {
 		"*.{ts,tsx,js,jsx,json,css}": [

packages/basalt/scripts/verify-pack.ts

@@ -31,16 +31,17 @@ function normalizePackPath(value: string) {
 }
 
 function parsePackJson(stdout: string) {
-	const trimmed = stdout.trim();
-	const start = trimmed.indexOf("{");
-	const end = trimmed.lastIndexOf("}");
-	if (start < 0 || end <= start) {
-		throw new Error("npm pack did not print JSON");
-	}
-	return JSON.parse(trimmed.slice(start, end + 1)) as {
+	const artifacts = Object.values(JSON.parse(stdout.trim())) as Array<{
+		name?: string;
+		version?: string;
 		filename?: string;
 		files?: Array<{ path?: string }>;
-	};
+	}>;
+	const artifact = artifacts[0];
+	if (artifacts.length !== 1 || artifact?.name !== pkg.name || artifact.version !== pkg.version) {
+		throw new Error("npm pack must describe exactly the expected package and version");
+	}
+	return artifact;
 }
 
 function walk(dir: string): string[] {

scripts/consumer-gate.test.ts

@@ -691,7 +691,7 @@ export const n = <><DonutChart /><DatePicker /><DataTable /></>;
 		const pkg = JSON.parse(readFileSync("package.json", "utf8")) as {
 			devDependencies?: Record<string, string>;
 		};
-		expect(pkg.devDependencies?.["@swc/core"]).toBe("1.16.2");
+		expect(pkg.devDependencies?.["@swc/core"]).toBe("1.16.13");
 		const gate = readFileSync("scripts/consumer-gate.ts", "utf8");
 		expect(gate).toContain('from "@swc/core"');
 		expect(gate).not.toContain("@vitejs/plugin-react-swc");