[renovate]

This PR contains the following updates:

Package	Type	Update	Change
indexmap	workspace.dependencies	patch	2.14.0 → 2.14.2
napi	workspace.dependencies	minor	3.11.0 → 3.16.1
napi-build	workspace.dependencies	minor	2.3.2 → 2.6.0
napi-derive	workspace.dependencies	minor	3.6.0 → 3.7.0
oxc_allocator (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_ast (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_codegen (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_data_structures (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_diagnostics (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_ecmascript (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_parser (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_semantic (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_span (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_str (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_syntax (source)	workspace.dependencies	minor	0.141 → 0.156
oxc_traverse (source)	workspace.dependencies	minor	0.141 → 0.156
thiserror	workspace.dependencies	patch	2.0.19 → 2.0.21

---

Release Notes

indexmap-rs/indexmap (indexmap)

v2.14.2

Compare Source

• Fix item hygiene in map and set macros. Previously, an internal const CAP
  could shadow the same name in the caller's namespace.
• Allow const initialization of empty indexmap_with_default! and
  indexset_with_default!. The hasher may also be omitted if it's inferrable.

v2.14.1

Compare Source

• Simplify comparisons where Equivalent isn't needed (Q = K).
• Unify index assertions for bounds checks.
• Fix (or expect) clippy lints.

napi-rs/napi-rs (napi)

v3.16.1

Compare Source

Fixed

• (napi) avoid a deadlock when a worker loads the addon during block_on (#​3670)

v3.16.0

Compare Source

Added

• (napi) support well-known symbol keys for class members (#​3665)
• (napi) support symbol_for keys for class members (#​3661)

Fixed

• (napi) compact class identity metadata (#​3667)
• (napi) keep the registered classes when a later load fails (#​3666)
• (napi) free define_class closures, honour static flags, avoid TS1016 in constructors (#​3662)
• (napi) free threadsafe function call data when the call fails (#​3656)

v3.15.0

Compare Source

Added

• (napi) cancel a ReadableStream through its Reader, and fix ReadableStream::cancel (#​3623)

Fixed

• (napi) set the custom GC aborted flag before Node closes its tsfn (#​3626)
• (napi) TypedArray input leaks and compat buffer copies on wasm (#​3612)
• (napi) copy managed array inputs (#​3607)
• (napi) reject a value of another class on builds without type tags (#​3610)
• (napi) drop unadopted class value and reset factory flag on failed conversion (#​3603)
• (napi) join the Tokio runtime threads at env teardown (#​3592)
• (napi) keep borrowed class args alive across AsyncTask/AsyncBlock (#​3584)

Other

• (cli) cover FreeBSD arm64 (#​3620)
• (cli) record the design behind the threaded WASI heap sync (#​3581)

v3.14.2

Compare Source

Fixed

• (napi) register the wasm cleanup through the env cleanup hook (#​3571)
• (napi) own NativeBorrowScope storage via NonNull to fix aliasing violation (#​3573)
• (napi) bound serde_json::Value conversion depth at 128 levels (#​3568)

v3.14.1

Compare Source

Fixed

• (napi) create objects with napi_define_properties on every Node version (#​3560)

v3.14.0

Compare Source

Added

• (napi) lock the allocator on threaded WASI and never hang after a worker crash (#​3552)

v3.13.0

Compare Source

Added

• (async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#​3541)

Fixed

• (napi) validate native payload provenance for External and instance data (#​3540)

v3.12.7

Compare Source

Fixed

• (napi) guard AsyncTask completion against env teardown (#​3536)

v3.12.6

Compare Source

Fixed

• (cli) drain outstanding async work before disposing a WASI binding (#​3528)

v3.12.5

Compare Source

Fixed

• fatal_exception noop in optimized builds (#​3509)

v3.12.4

Compare Source

Security

• Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #​3506.
• The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #​3507.
• ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #​3503.

Fixed

• (napi) return errors from the serde deserializer for unexpected JS value shapes (#​3507)
• (napi) validate wrapped payload provenance in Object::unwrap/remove_wrapped (#​3506)
• (napi) point from_external slices at the engine-owned copy after finalize reclaims the source (#​3503)

v3.12.3

Compare Source

Fixed

• CurrentThread waker-stack deadlocks and threadless-wasm Buffer detachment (#​3489)
• (napi) catch panics in closure trampolines instead of aborting (#​3473)

Other

• (napi) keep anyhow error cause when converting (#​3477)
• (napi) outline threadsafe callback dispatch (#​3465)
• (napi) outline class instance construction (#​3464)

v3.12.2

Compare Source

Fixed

• (napi) memory safety in PromiseRaw callbacks and AbortSignal conversion (#​3458)

v3.12.1

Compare Source

Fixed

• (napi) stop unloading addons with live native code, preserve non-Error rejections, and add the wasm teardown barrier (#​3423)
• (wasi) avoid randomness during module registration (#​3447)

v3.12.0

Compare Source

Added

• (cli) support non-threaded WASI targets (#​3353)

dtolnay/thiserror (thiserror)

v2.0.21

Compare Source

• Fix parsing of generic unit variants in display expressions (#​459)

v2.0.20

Compare Source

• Suppress redundant_field_names clippy lint in generated code (#​454)

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 12:00 AM and 04:59 AM, Monday through Wednesday (* 0-4 * * 1-3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.