chore(deps): update mimalloc submodules to v2.5.0 and v3.5.0, fix wasi build

[Brooooooklyn]

Two changes.

1. Submodules pinned to release tags

submodule	before	after
libmimalloc-sys/c_src/mimalloc	fef6b0dd (v2.3.2-19)	989c8ebc (v2.5.0)
libmimalloc-sys/c_src/mimalloc3	d7d90c6f (v3.3.2-33)	18b08671 (v3.5.0)

Runtime check of the linked library:

mi_version() = 20500   (default)
mi_version() = 30500   (--features v3)

Upstream API review

v2 option enum is unchanged. Every mi_option_* constant in libmimalloc-sys/src/extended.rs still matches v2.5.0 index for index.

v3 renamed one option. mi_option_visit_abandoned became mi_option_deprecated_visit_abandoned at the same index 28. No other index moved.

v3 cmake options still work. MI_TLS_MODEL_LOCAL and MI_TLS_RECURSE_GUARD are now deprecated aliases of MI_TLS_MODEL=LOCAL, but v3.5.0 still honors them. The macOS TLS fix in build.rs stays active:

Compiler defines : MI_DEBUG=2;MI_SHOW_ERRORS=1;MI_TLS_MODEL_LOCAL=1;MI_TLS_RECURSE_GUARD=1

MI_SECURE=ON also still maps to MI_SECURE=4 in v3.

2. emnapi bumped to 2.0 alpha to fix the wasi build

Build example wasm32-wasip1-threads was failing. The cause is not the submodule bump — it breaks on main too.

napi-build 2.4.1 asks wasm-ld to export two symbols with a hard --export:

wasm-ld: error: symbol exported via --export not found: emnapi_create_env
wasm-ld: error: symbol exported via --export not found: emnapi_delete_env

I checked both static libraries directly:

package	emnapi_create_env / emnapi_delete_env in libemnapi-napi-rs-mt.a
emnapi@1.11.1	absent
emnapi@2.0.0-alpha.4	present

So example/package.json now declares:

-    "@emnapi/core": "^1.11.1",
-    "@emnapi/runtime": "^1.11.1",
-    "@napi-rs/cli": "^3.7.2"
+    "@emnapi/core": "^2.0.0-alpha.4",
+    "@emnapi/runtime": "^2.0.0-alpha.4",
+    "@napi-rs/cli": "^3.8.6",
+    "emnapi": "^2.0.0-alpha.4"

emnapi becomes a direct dependency because the static library it ships is what the linker consumes.

@napi-rs/cli has to move to 3.8.6 as well. Version 3.7.2 hard-depends on emnapi@^1.11.1, so a nested 1.11.1 copy stays in node_modules and the CLI stops with emnapi version mismatch: emnapi@1.11.1, @emnapi/core@2.0.0-alpha.4, @emnapi/runtime@2.0.0-alpha.4. In 3.8.6 emnapi is an optional peer dependency, so exactly one copy remains.

Verification

I reproduced the wasi failure locally with wasi-sdk, then confirmed the fix.

yarn install --immutable   (clean node_modules)
  emnapi         2.0.0-alpha.4
  @emnapi/core   2.0.0-alpha.4
  @emnapi/runtime 2.0.0-alpha.4
  @napi-rs/cli   3.8.6

napi build --target wasm32-wasip1-threads             OK   (clean target dir)
napi build --target wasm32-wasip1-threads --release   OK
  wasm exports: emnapi_create_env, emnapi_delete_env, napi_register_wasm_v1, ...

napi build --target aarch64-apple-darwin              OK   (also --release, --features v3)

Rust side, every CI command passes on macOS arm64:

cargo build/test    secure | default | extended | v3 | extended,v3   OK
cargo run -p libmimalloc-sys-test
  default    PASSED 258 tests
  extended   PASSED 258 tests
  secure     PASSED 258 tests
  v3         PASSED 251 tests
cargo fmt --all -- --check                                           OK
cargo clippy --workspace -- -D warnings                              OK

Known issues, not touched by this PR

1. cargo test -p libmimalloc-sys2 --features extended fails on runtime_stable_option (libmimalloc-sys/src/extended.rs:1088). The same failure reproduces on the old pin fef6b0dd. The cause is MI_SHOW_ERRORS=ON in debug builds. CI never runs this command, so it stays hidden.
2. The Rust option constants use v2 numbering. Under the v3 feature, 11 constants point at the wrong v3 option. This offset existed before this bump and did not grow.
3. A local wasi build now writes index.wasi.cjs, browser.js, wasi-worker.mjs and three more files into example/. They are not in example/.gitignore. I removed them by hand instead of widening the ignore list here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SnyHZkCmxccwr16H9H3WtS

---

Note

Medium Risk
Example-only dependency bump, but it pins pre-release emnapi 2.0 alphas, so the example build may be less stable than the previous 1.x line.

Overview
Updates the mimalloc NAPI example to emnapi 2.0.0-alpha.4 (@emnapi/core, @emnapi/runtime, and a new direct emnapi dep) and @napi-rs/cli 3.8.6.

The lockfile follows those bumps, including wasm-tools 1.1.0 and optional TypeScript 6 pulled in by the CLI.

^{Reviewed by Cursor Bugbot for commit d1c6764. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_3d2911a7-004a-4579-9f96-a158d0abd500)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_1635ad37-7010-432f-b308-e6ca30e99f76)