chore(deps): update rust crate napi to v3.13.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
napi	dependencies	minor	3.8.6 → 3.13.0

---

Release Notes

napi-rs/napi-rs (napi)

v3.13.0

Compare Source

Added

• (async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#​3541)

Fixed

• (napi) validate native payload provenance for External and instance data (#​3540)

v3.12.7

Compare Source

Fixed

• (napi) guard AsyncTask completion against env teardown (#​3536)

v3.12.6

Compare Source

Fixed

• (cli) drain outstanding async work before disposing a WASI binding (#​3528)

v3.12.5

Compare Source

Fixed

• fatal_exception noop in optimized builds (#​3509)

v3.12.4

Compare Source

Security

• Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #​3506.
• The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #​3507.
• ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #​3503.

Fixed

• (napi) return errors from the serde deserializer for unexpected JS value shapes (#​3507)
• (napi) validate wrapped payload provenance in Object::unwrap/remove_wrapped (#​3506)
• (napi) point from_external slices at the engine-owned copy after finalize reclaims the source (#​3503)

v3.12.3

Compare Source

Fixed

• CurrentThread waker-stack deadlocks and threadless-wasm Buffer detachment (#​3489)
• (napi) catch panics in closure trampolines instead of aborting (#​3473)

Other

• (napi) keep anyhow error cause when converting (#​3477)
• (napi) outline threadsafe callback dispatch (#​3465)
• (napi) outline class instance construction (#​3464)

v3.12.2

Compare Source

Fixed

• (napi) memory safety in PromiseRaw callbacks and AbortSignal conversion (#​3458)

v3.12.1

Compare Source

Fixed

• (napi) stop unloading addons with live native code, preserve non-Error rejections, and add the wasm teardown barrier (#​3423)
• (wasi) avoid randomness during module registration (#​3447)

v3.12.0

Compare Source

Added

• (cli) support non-threaded WASI targets (#​3353)

v3.11.0

Compare Source

Added

• unforgeable #[napi] class identity via Node object type tags (#​3405)
• (napi) add pluggable async runtime backend (#​3352)

Fixed

• (napi) release JsDeferred tsfn on null-env teardown drain (#​3404 follow-up) (#​3408)
• (napi) guard JsDeferred against env teardown (#​3404)
• (napi) register the async runtime env cleanup hook per registration (#​3400)

Other

• (napi) share tracing callsite (#​3409)

v3.10.5

Compare Source

Fixed

• (napi) release FunctionRef off the JS thread via the custom-GC TSFN (#​3394)

v3.10.4

Compare Source

Fixed

• (cli) align build and project configuration (#​3387)

Other

• (readme) point sponsors image at napi.rs/sponsors.svg (#​3379)

v3.10.3

Compare Source

Fixed

• (napi) preserve the JS error object when cloning an Error off-thread (#​3375)

v3.10.2

Compare Source

Fixed

• (napi) keep message and cause when cloning a JS-exception Error off-thread (#​3373)

v3.10.1

Compare Source

Fixed

• (napi) release Error's exception reference via the custom GC when dropped off-thread. (#​3370)
• (napi) stop ref exception object in ThreadsafeFunction sync-throw path on wasm targets (#​3369)

Other

• (napi) share class accessor trampolines (#​3364)
• optimize object field raw property access (#​3365)

v3.10.0

Compare Source

Added

• (napi) implement To/FromNapiValue for OsString, OsStr, Path and PathBuf (#​3339)

Fixed

• (napi) route custom-GC Buffer/TypedArray cross-thread drops through the owning isolate (#​3357) (#​3360)

v3.9.4

Compare Source

Other

• (napi-derive) outline #[napi(object)] field-error decoration (#​3338)

v3.9.3

Compare Source

Fixed

• (napi) sync referred flag when creating a weak ThreadsafeFunction (#​3337)

Other

• (napi) outline non-generic core of ThreadsafeFunction::create (#​3334)

v3.9.2

Compare Source

Fixed

• (napi) ReadableStream Reader loses chunks and aborts on errored streams (#​3328)

v3.9.1

Compare Source

Fixed

• (napi) unify Reference finalize callbacks on Arc (Rc/Arc type confusion) (#​3313)
• (napi) zero-copy external strings, fix WASI double-free (#​3308)
• (napi) experimental node_api_create_object_with_properties (#​3304)

v3.9.0

Compare Source

Added

• (napi) add ThreadsafeFunction::call_async_catch to handle errors in callback functions (#​3291)

Fixed

• (deps) update rust crate ctor to v1 (#​3276)
• (deps) update rust crate ctor to 0.13.0 (#​3275)
• (deps) update rust crate ctor to 0.12.0 (#​3271)

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Sunday and Saturday (* 0-6 * * 6,0)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.