chore(deps): update napi to v3.12.4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
napi	workspace.dependencies	patch	3.12.3 → 3.12.4
napi-derive	workspace.dependencies	patch	3.6.4 → 3.6.5

---

Release Notes

napi-rs/napi-rs (napi)

v3.12.4

Compare Source

Security

• Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #​3506.
• The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #​3507.
• ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #​3503.

Fixed

• (napi) return errors from the serde deserializer for unexpected JS value shapes (#​3507)
• (napi) validate wrapped payload provenance in Object::unwrap/remove_wrapped (#​3506)
• (napi) point from_external slices at the engine-owned copy after finalize reclaims the source (#​3503)

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​napi@​3.12.3 ⏵ 3.12.4
	cargo/​napi-derive@​3.6.4 ⏵ 3.6.5

View full report