fix: move kernel-store to better-sqlite3 13, fix the renovatebot workflow

[rekmarks-consensys-1]

Two fixes, folded together because the second is what lets CI run at all.

renovatebot.yml: ubuntu-24.04 → ubuntu-latest

ubuntu-24.04 is not a valid runner slug here, so the job could not start. The remaining hunks are prettier on the workflow file and renovate.json.

kernel-store: better-sqlite3 12 → 13 (folds in #1045)

On Node 24.20.0, 12.x aborts the process during teardown:

node::RemoveEnvironmentCleanupHook(Isolate*, CleanupHook, void*) at ../src/api/hooks.cc:142
Assertion failed: (env) != nullptr
  Statement::~Statement() [better_sqlite3.node]

The destructor runs after the environment is gone and asserts on the way out. Everything it kills has already passed, so it surfaces as Worker exited unexpectedly rather than as a test failure anyone can read.

Nothing in this repository changed to cause it. CI's matrix floats on 24.x, and had not run since 2026-09-03, when the runner still resolved that to 24.19.0. It now resolves to 24.20.0.

It is not a missing close

The suites that hit this close their databases correctly. Narrowed on 24.20.0:

Repro	Result
Plain script, statement alive at exit, no close()	clean
Vitest worker + real driver, database left open	clean
Vitest worker + database + live worker thread	clean
Full integration test	aborts
Full integration test on Node 24.18.0	clean

Same code, same test, only the Node patch differs — which places it between the two Node releases rather than in our teardown.

Why 13.x is safe here

It is a major, but it moves none of the surface this driver uses — prepare, run, get, all, iterate, pluck, transaction, exec, close — and its engines.node floor is >=22, the same one this package already declares. The changelog entry is marked breaking for that engine floor alone.

Pinning the Node matrix to a known-good patch would also go green, and would hide this until the next bump. The floating 24.x is a separate reproducibility question worth having on its own terms.

Testing

Verified on Node 24.20.0 with the bump:

• Unit suite: 53/53 tasks
• Integration suite: all pass, no abort, no worker timeout
• kernel-node-runtime e2e: went from 9 failures plus the abort to running normally
• Node 22.23.2: kernel-store passes

One caveat: remote-comms.test.ts > handles remote intentional disconnect without reconnecting fails locally for me on 24.18.0, 24.19.0 and 24.20.0 alike, with and without this bump. Worth watching in CI, but it is not related to either change here.

🤖 Generated with Claude Code

---

Note

Medium Risk
The native better-sqlite3 major bump affects install/build and the Node SQLite path for consumers; CI runner change is low risk.

Overview
Updates the renovatebot workflow to run on ubuntu-latest instead of the invalid ubuntu-24.04 slug, with minor YAML comment/quote formatting. renovate.json is collapsed to a single-line extends entry only.

In @metamask/kernel-store, upgrades better-sqlite3 from ^12.4.1 to ^13.0.3 (lockfile included) and documents it as breaking in the changelog: Node 22+ is required (already the package engines floor), mainly to avoid a Node 24 teardown crash in 12.x that can kill test workers after tests pass. No application driver code changes are part of this diff.

^{Reviewed by Cursor Bugbot for commit 39bb2f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	better-sqlite3@​12.4.6 ⏵ 13.0.3	+12

View full report

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	73.05% 🟰 ±0%	9790 / 13401
🔵	Statements	72.9% 🟰 ±0%	9954 / 13653
🔵	Functions	73.6% 🟰 ±0%	2301 / 3126
🔵	Branches	67.27% 🟰 ±0%	4023 / 5980

File Coverage

No changed files found.

Generated in workflow #4833 for commit 39bb2f2 by the Vitest Coverage Report Action