ci(rust): bump napi from 3.12.2 to 3.13.0

[dependabot]

Bumps napi from 3.12.2 to 3.13.0.

Release notes

Sourced from napi's releases.

napi-v3.13.0

Added

• (async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#3541)

Fixed

• (napi) validate native payload provenance for External and instance data (#3540)

napi-v3.12.7

Fixed

• (napi) guard AsyncTask completion against env teardown (#3536)

napi-v3.12.6

Fixed

• (cli) drain outstanding async work before disposing a WASI binding (#3528)

napi-v3.12.5

Fixed

• fatal_exception noop in optimized builds (#3509)

napi-v3.12.4

Security

• Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #3506.
• The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #3507.
• ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #3503.

Fixed

• (napi) return errors from the serde deserializer for unexpected JS value shapes (#3507)
• (napi) validate wrapped payload provenance in Object::unwrap/remove_wrapped (#3506)
• (napi) point from_external slices at the engine-owned copy after finalize reclaims the source (#3503)

napi-v3.12.3

Fixed

• CurrentThread waker-stack deadlocks and threadless-wasm Buffer detachment (#3489)
• (napi) catch panics in closure trampolines instead of aborting (#3473)

Other

• (napi) keep anyhow error cause when converting (#3477)
• (napi) outline threadsafe callback dispatch (#3465)
• (napi) outline class instance construction (#3464)

Commits

• 2763e12 chore: release (#3538)
• 5ae5cf6 chore(release): publish
• 0da138e feat(cli): self-sign OpenHarmony artifacts with --ohos-sign (#3539)
• 2499a63 feat(async-runtime): offer the MultiThread flavor on wasm32-wasip1-threads (#...
• 886bd07 chore(deps): update dependency oxc-parser to ^0.151.0 (#3542)
• edb0a29 fix(napi): validate native payload provenance for External and instance data ...
• 38162bb chore: release (#3529)
• ec3d8ea fix(napi): guard AsyncTask completion against env teardown (#3536)
• 96ed267 chore(deps): update release-plz/action action to v0.5.139 (#3537)
• b2c9f3b chore(deps): update release-plz/action action to v0.5.138 (#3533)
• Additional commits viewable in compare view

[dependabot]

Superseded by #126.