chore(deps): bump neon from 0.9.1 to 0.10.1 in /native

[dependabot[bot]]

Bumps neon from 0.9.1 to 0.10.1.

Release notes

Sourced from neon's releases.

v0.10.1

Fix a soundness hole in JsArrayBuffer::external and JsBuffer::external (neon-bindings/neon#897).

Thanks to @​Cassy343 for finding the issue!

In previous versions of Neon, it was possible to create a JsArrayBuffer or JsBuffer that references data without the 'static lifetime.

pub fn soundness_hole(mut cx: FunctionContext) -> JsResult<JsArrayBuffer> {
    let mut data = vec![0u8, 1, 2, 3];
// Creating an external from `&amp;mut [u8]` instead of `Vec&lt;u8&gt;` since there is a blanket impl
// of `AsMut&lt;T&gt; for &amp;mut T`
let buf = JsArrayBuffer::external(&amp;mut cx, data.as_mut_slice());

// `buf` is still holding a reference to `data`!
drop(data);

Ok(buf)

}

v0.10.0

See the Neon 0.10 Migration Guide for more details about new features and breaking changes.

Features

• New buffer borrowing API
• Added JoinHandle for Channel::send
• JsPromise and TaskBuilder
• Handle panics and exceptions in Channels and Tasks
• Function call / construct builders and simplify low level call
• Create functions from closures

Minor Improvements

• Performance improvements
• Rename N-API to Node-API in docs to match Node changes
• Remove unused cslice dependency
• Switch to syn-mid for faster compile times
• Downcast in Object::get
• Added migration guide
• Added Object::get_opt and Object::get_value

Fixes

• [Safety] Make it harder to store and forge Throw
• [Soundness] Make JsValue types !Copy

... (truncated)

Changelog

Sourced from neon's changelog.

Version 0.10.1

Fix a soundness hole in JsArrayBuffer::external and JsBuffer::external (neon-bindings/neon#897).

Thanks to @​Cassy343 for finding the issue!

In previous versions of Neon, it was possible to create a JsArrayBuffer or JsBuffer that references data without the 'static lifetime.

pub fn soundness_hole(mut cx: FunctionContext) -> JsResult<JsArrayBuffer> {
    let mut data = vec![0u8, 1, 2, 3];
// Creating an external from `&amp;mut [u8]` instead of `Vec&lt;u8&gt;` since there is a blanket impl
// of `AsMut&lt;T&gt; for &amp;mut T`
let buf = JsArrayBuffer::external(&amp;mut cx, data.as_mut_slice());

// `buf` is still holding a reference to `data`!
drop(data);

Ok(buf)

}

Version 0.10

See the Neon 0.10 Migration Guide for more details about new features and breaking changes.

Features

• New buffer borrowing API
• Added JoinHandle for Channel::send
• JsPromise and TaskBuilder
• Handle panics and exceptions in Channels and Tasks
• Function call / construct builders and simplify low level call
• Create functions from closures

Minor Improvements

• Performance improvements
• Rename N-API to Node-API in docs to match Node changes
• Remove unused cslice dependency
• Switch to syn-mid for faster compile times
• Downcast in Object::get
• Added migration guide
• Added Object::get_opt and Object::get_value

Fixes

... (truncated)

Commits

• c17014e Merge pull request #899 from neon-bindings/kv/fix-external-soundness
• 9fa8768 Neon 0.10.1
• 4e350ea soundness(neon): Require T: 'static on JsArrayBuffer::external and `JsBuf...
• 779f733 Merge pull request #870 from neon-bindings/kv/0.10-release
• 29d8f21 neon 0.10 and create-neon 0.2
• b386ec2 Merge pull request #868 from neon-bindings/migration-guide-get-union-types
• f3b7eb5 Delete stray semicolons
• d6196dc Migration guide entry for Object::get_value() and Object::get_opt().
• f942e99 Merge pull request #867 from neon-bindings/object-get-conveniences
• 9baa676 Doc comments
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ResetPower/Epherome/network/alerts).

[ResetPower]

oh! merci beaucoup ~