chore(wasm-pack): upgrade wasm-pack to now-functioning v0.15.0

[abcxff]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[abcxff]

• fix(rivetkit): infer T from step/tryStep config object in workflow context wrapper #5124
• chore(wasm-pack): upgrade wasm-pack to now-functioning v0.15.0 #5125 👈 (View in Graphite)
• feat(workflow-engine): add retryOnTimeout opt-in for step timeout retries #5089 : 1 other dependent PR (#5065 )
• fix(rivetkit): wire CancellationToken through waitForNamesAvailable to eliminate KV busy-polling #5063 : 1 other dependent PR (#5050 )
• fix(rivetkit): fix BigInt serialization in inspector workflow history and state deserialization #5058
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[railway-app]

🚅 Deployed to the rivet-pr-5125 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
kitchen-sink	❌ Build Failed (View Logs)	Web	Jun 3, 2026 at 1:10 am
website	😴 Sleeping (View Logs)	Web	Jun 2, 2026 at 8:26 pm
mcp-hub	✅ Success (View Logs)	Web	Jun 2, 2026 at 8:18 pm
frontend-cloud	❌ Build Failed (View Logs)	Web	Jun 2, 2026 at 8:17 pm
frontend-inspector	❌ Build Failed (View Logs)	Web	Jun 2, 2026 at 8:17 pm
ladle	❌ Build Failed (View Logs)	Web	Jun 2, 2026 at 8:17 pm

[claude]

Review: chore(wasm-pack): upgrade wasm-pack to v0.15.0

This is a clean maintenance PR. Here is the breakdown:

What it does

• Upgrades wasm-pack from 0.14.0 to 0.15.0
• Removes patches/wasm-pack@0.14.0.patch — the patch was fixing an incorrect binary download URL (using drager instead of wasm-bindgen as the GitHub author). v0.15.0 ships this fix natively.
• Re-enables the build-wasm CI job that was commented out (presumably disabled to work around the broken 0.14.0 download).

Security improvement

The lock file cleanup removes several deprecated/vulnerable transitive deps pulled in via binary-install@1.1.2 (wasm-pack 0.14.0's binary downloader):

• tar@6.2.1 — deprecated with "widely publicized security vulnerabilities"
• binary-install@1.1.2 — deprecated
• axios@0.26.1 — old version with known CVEs

These are replaced by tar@7.5.11 in wasm-pack 0.15.0's dep graph, which is already in the lockfile.

One observation

The re-enabled build-wasm job uploads a wasm-package artifact, but the publish job does not list build-wasm in its needs and does not download that artifact — it sets SKIP_WASM_BUILD: "1" and excludes @rivetkit/rivetkit-wasm from the build step. This appears to be a pre-existing gap (same job structure existed before it was commented out), so it is not introduced here. Worth confirming whether the artifact is consumed in a separate publish path or if the build job runs purely as a CI validation gate.

Overall

Low-risk, well-scoped change. Correct approach — fix the root cause (broken upstream) rather than maintaining the patch indefinitely. No concerns with the implementation.

[abcxff]

Merge activity

• Jun 3, 1:04 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 3, 1:10 AM UTC: Graphite rebased this pull request as part of a merge.
• Jun 3, 1:10 AM UTC: @abcxff merged this pull request with Graphite.