chore(deps)(deps): bump the napi-rs group across 1 directory with 3 updates

[dependabot]

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

Bumps the napi-rs group with 3 updates in the / directory: napi, napi-derive and napi-build.

Updates napi from 3.12.2 to 3.12.4

Release notes

Sourced from napi's releases.

napi-v3.12.4

Security

• Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #3506.
• The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #3507.
• ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #3503.

Fixed

• (napi) return errors from the serde deserializer for unexpected JS value shapes (#3507)
• (napi) validate wrapped payload provenance in Object::unwrap/remove_wrapped (#3506)
• (napi) point from_external slices at the engine-owned copy after finalize reclaims the source (#3503)

napi-v3.12.3

Fixed

• CurrentThread waker-stack deadlocks and threadless-wasm Buffer detachment (#3489)
• (napi) catch panics in closure trampolines instead of aborting (#3473)

Other

• (napi) keep anyhow error cause when converting (#3477)
• (napi) outline threadsafe callback dispatch (#3465)
• (napi) outline class instance construction (#3464)

Commits

• 1492b22 chore: release (#3502)
• 828983a fix(napi): return errors from the serde deserializer for unexpected JS value ...
• 606b142 fix(napi): validate wrapped payload provenance in Object::unwrap/remove_wrapp...
• a75d89f fix(napi): point from_external slices at the engine-owned copy after finalize...
• e414c8c fix(deps): update dependency obug to v3 (#3499)
• a5fedde chore(deps): update release-plz/action action to v0.5.136 (#3505)
• 31c27a1 chore: release (#3470)
• 7e3f293 chore(release): publish
• f772ee0 fix(cli): align generated file formats (#3501)
• 1cf5ec5 fix(cli): use accessible WASI preopen root on Android (#3485)
• Additional commits viewable in compare view

Updates napi-derive from 3.6.3 to 3.6.5

Release notes

Sourced from napi-derive's releases.

napi-derive-v3.6.5

Other

• update Cargo.toml dependencies

napi-derive-v3.6.4

Fixed

• (deps) update rust crate convert_case to 0.12 (#3469)

Commits

• 1492b22 chore: release (#3502)
• 828983a fix(napi): return errors from the serde deserializer for unexpected JS value ...
• 606b142 fix(napi): validate wrapped payload provenance in Object::unwrap/remove_wrapp...
• a75d89f fix(napi): point from_external slices at the engine-owned copy after finalize...
• e414c8c fix(deps): update dependency obug to v3 (#3499)
• a5fedde chore(deps): update release-plz/action action to v0.5.136 (#3505)
• 31c27a1 chore: release (#3470)
• 7e3f293 chore(release): publish
• f772ee0 fix(cli): align generated file formats (#3501)
• 1cf5ec5 fix(cli): use accessible WASI preopen root on Android (#3485)
• Additional commits viewable in compare view

Updates napi-build from 2.4.1 to 2.4.3

Release notes

Sourced from napi-build's releases.

napi-build-v2.4.3

Fixed

• (cli) drain outstanding async work before disposing a WASI binding (#3528)

napi-build-v2.4.2

Fixed

• (cli,build) make wasm32-wasip1-threads link with wasi-sdk 34 and Rust nightly (#3492)

Commits

• e2f21c6 chore: release (#3525)
• 134045a chore(release): publish
• 1391704 fix(cli): drain outstanding async work before disposing a WASI binding (#3528)
• c50beb0 chore(release): publish
• 98ed126 fix(cli): give reconciliation identity-resolver tests realistic time budgets ...
• f9be941 fix(cli): settle threaded WASI disposal after async work (#3526)
• 43100ba chore: release (#3508)
• bb7b75a chore(release): publish
• 89d7a0b chore(deps): update dependency oxfmt to ^0.68.0 (#3519)
• 5554591 fix(cli): rate-limit failed incarnation probes and let reconciliation tests i...
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: rust. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.