fix(kernel-store): move to better-sqlite3 13, which survives teardown on Node 24.20

[sirtimid]

The failure

On Node 24.20.0, better-sqlite3 12.x aborts the process during shutdown:

node::RemoveEnvironmentCleanupHook(Isolate*, CleanupHook, void*) at ../src/api/hooks.cc:142
Assertion failed: (env) != nullptr
  Statement::~Statement() [better_sqlite3.node]

The destructor runs after the environment is gone and asserts on the way out. Everything it kills has already passed, so it surfaces as Worker exited unexpectedly rather than as a test failure anyone can read.

Nothing in this repository changed. CI's matrix floats on 24.x, and had not run since 2026-09-03, when the runner still resolved that to 24.19.0. It now resolves to 24.20.0.

It is not a missing close

The suites that hit this close their databases correctly. I narrowed it on 24.20.0:

Repro	Result
Plain script, statement alive at exit, no close()	clean
Vitest worker + real driver, database left open	clean
Vitest worker + database + live worker thread	clean
Full integration test	aborts
Full integration test on Node 24.18.0	clean

Same code, same test, only the Node patch differs — which places it between the two Node releases rather than in our teardown.

The fix

13.x is a major, but it moves none of the surface this driver uses — prepare, run, get, all, iterate, pluck, transaction, exec, close — and its engines.node floor is >=22, the same one this package already declares.

Verified on Node 24.20.0 with the bump:

• Unit suite: 53/53 tasks
• Integration suite: all pass, no abort, no worker timeout
• kernel-node-runtime e2e: went from 9 failures plus the abort to running normally
• Node 22.23.2: kernel-store passes

One caveat, so nobody is surprised

remote-comms.test.ts > handles remote intentional disconnect without reconnecting fails locally for me, and it does so on 24.18.0, 24.19.0 and 24.20.0 alike, with and without this bump. It is flaky in my environment rather than related to either the Node bump or this change — I initially misread it as a second Node regression, then reproduced the failure on 24.18.0 twice in a row. Worth watching in CI, but it is not what this PR is about.

Why not pin Node instead

Pinning the matrix to a known-good patch would go green too, and hide this until the next time someone bumps Node. The floating 24.x is a separate reproducibility question worth having on its own terms; this is the actual defect.

Needs #1043 to land before CI here can run at all.

🤖 Generated with Claude Code

---

Note

Medium Risk
Major native-addon upgrade affects all Node SQLite storage paths and install/rebuild behavior, though application code is untouched and the Node engine floor is unchanged.

Overview
Bumps better-sqlite3 from ^12.4.1 to ^13.0.3 in @metamask/kernel-store (plus lockfile). There are no changes to the Node SQLite driver in this repo.

This addresses a Node 24.20 shutdown bug where 12.x can abort during Statement teardown (RemoveEnvironmentCleanupHook after the environment is gone), which shows up as Vitest workers dying after tests pass. The changelog marks the bump as breaking for semver because 13.x is a major, though the package already requires Node ≥22 and the driver APIs in use are unchanged.

Lockfile churn drops bindings / prebuild-install from the better-sqlite3 resolution path and aligns node-addon-api with 13.x’s native build setup.

^{Reviewed by Cursor Bugbot for commit adfc6c4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	better-sqlite3@​12.4.6 ⏵ 13.0.3	+12

View full report

[sirtimid]

Folded into #1043. The two were blocking each other: #1043's jobs failed on the better-sqlite3 abort, and this PR failed at job setup on the action-pinning policy that #1043 fixes. Neither could go green alone, so the bump now rides on #1043.