chore(deps): update rust crates

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
clap	dependencies	patch	4.6.1 → 4.6.7
handlebars	dependencies	patch	6.4.0 → 6.4.4
napi	dependencies	minor	3.9.0 → 3.14.1
napi-build	build-dependencies	minor	2.3.2 → 2.6.0
napi-derive	dependencies	minor	3.5.6 → 3.6.11
serde (source)	dependencies	patch	1.0.228 → 1.0.229
toml_edit	build-dependencies	patch	0.25.11+spec-1.1.0 → 0.25.15

---

Release Notes

clap-rs/clap (clap)

v4.6.7

Compare Source

v4.6.6

Compare Source

Features

• Add Command::get_overridden_usage

v4.6.5

Compare Source

v4.6.4

Compare Source

Internal

• Update to syn v3

v4.6.3

Compare Source

Fixes

• (derive) Allow "literal".function() as attribute values

v4.6.2

Compare Source

Fixes

• (help) Say alias when there is only one

sunng87/handlebars-rust (handlebars)

v6.4.4

Compare Source

• [Changed] We have to revert preserve_json_order as a default feature. Users
  who need this can still enable it for handlebars-rust, or enable
  preserve_order for you serde_json.

v6.4.3

Compare Source

• [Fixed] Panic when using whitespace omission (~) on an else if
  chain tag, e.g. {{~else if cond}}. The leading tilde is now handled
  consistently with {{~else}} [#​766]
• [Added] preserve_json_order feature flag that gates serde_json's
  preserve_order feature. Enabled by default to keep insertion-order key
  iteration; disable with default-features = false to restore alphabetical
  JSON object key ordering. [#​767]
• [Changed] Drop the pprof dev-dependency (and its inferno /
  quick-xml transitive deps) from benchmarks. This removes the vulnerable
  quick-xml 0.26 transitive dependency ([#​764], [#​765]); the upgrade was
  blocked upstream because pprof pins inferno 0.11. Benchmarks now use
  plain criterion without in-repo flamegraph generation.

v6.4.2

Compare Source

• [Fixed] Access to local variables like @key, @index, etc. in #with and
  partial block [#​758]
• [Fixed] Preserve ordering when iterating an array context inside a partial
  that receives hash parameters [#​760]
• [Changed] Enable serde_json preserve_order feature. JSON objects are now
  iterated in insertion order (matching Handlebars.js semantics) instead of
  alphabetical key order. This fixes index-key ordering for array contexts
  converted into objects by partial hash parameters (e.g. "10" no longer
  sorts before "2").

v6.4.1

Compare Source

• [Fixed] Allow using @partial-block with block include and fallback template [#​752]

napi-rs/napi-rs (napi)

v3.14.1

Compare Source

Fixed

• (napi) create objects with napi_define_properties on every Node version (#​3560)

v3.14.0

Compare Source

Added

• (napi) lock the allocator on threaded WASI and never hang after a worker crash (#​3552)

v3.13.0

Compare Source

Added

• (async-runtime) offer the MultiThread flavor on wasm32-wasip1-threads (#​3541)

Fixed

• (napi) validate native payload provenance for External and instance data (#​3540)

v3.12.7

Compare Source

Fixed

• (napi) guard AsyncTask completion against env teardown (#​3536)

v3.12.6

Compare Source

Fixed

• (cli) drain outstanding async work before disposing a WASI binding (#​3528)

v3.12.5

Compare Source

Fixed

• fatal_exception noop in optimized builds (#​3509)

v3.12.4

Compare Source

Security

• Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #​3506.
• The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #​3507.
• ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #​3503.

Fixed

• (napi) return errors from the serde deserializer for unexpected JS value shapes (#​3507)
• (napi) validate wrapped payload provenance in Object::unwrap/remove_wrapped (#​3506)
• (napi) point from_external slices at the engine-owned copy after finalize reclaims the source (#​3503)

v3.12.3

Compare Source

Fixed

• CurrentThread waker-stack deadlocks and threadless-wasm Buffer detachment (#​3489)
• (napi) catch panics in closure trampolines instead of aborting (#​3473)

Other

• (napi) keep anyhow error cause when converting (#​3477)
• (napi) outline threadsafe callback dispatch (#​3465)
• (napi) outline class instance construction (#​3464)

v3.12.2

Compare Source

Fixed

• (napi) memory safety in PromiseRaw callbacks and AbortSignal conversion (#​3458)

v3.12.1

Compare Source

Fixed

• (napi) stop unloading addons with live native code, preserve non-Error rejections, and add the wasm teardown barrier (#​3423)
• (wasi) avoid randomness during module registration (#​3447)

v3.12.0

Compare Source

Added

• (cli) support non-threaded WASI targets (#​3353)

v3.11.0

Compare Source

Added

• unforgeable #[napi] class identity via Node object type tags (#​3405)
• (napi) add pluggable async runtime backend (#​3352)

Fixed

• (napi) release JsDeferred tsfn on null-env teardown drain (#​3404 follow-up) (#​3408)
• (napi) guard JsDeferred against env teardown (#​3404)
• (napi) register the async runtime env cleanup hook per registration (#​3400)

Other

• (napi) share tracing callsite (#​3409)

v3.10.5

Compare Source

Fixed

• (napi) release FunctionRef off the JS thread via the custom-GC TSFN (#​3394)

v3.10.4

Compare Source

Fixed

• (cli) align build and project configuration (#​3387)

Other

• (readme) point sponsors image at napi.rs/sponsors.svg (#​3379)

v3.10.3

Compare Source

Fixed

• (napi) preserve the JS error object when cloning an Error off-thread (#​3375)

v3.10.2

Compare Source

Fixed

• (napi) keep message and cause when cloning a JS-exception Error off-thread (#​3373)

v3.10.1

Compare Source

Fixed

• (napi) release Error's exception reference via the custom GC when dropped off-thread. (#​3370)
• (napi) stop ref exception object in ThreadsafeFunction sync-throw path on wasm targets (#​3369)

Other

• (napi) share class accessor trampolines (#​3364)
• optimize object field raw property access (#​3365)

v3.10.0

Compare Source

Added

• (napi) implement To/FromNapiValue for OsString, OsStr, Path and PathBuf (#​3339)

Fixed

• (napi) route custom-GC Buffer/TypedArray cross-thread drops through the owning isolate (#​3357) (#​3360)

v3.9.4

Compare Source

Other

• (napi-derive) outline #[napi(object)] field-error decoration (#​3338)

v3.9.3

Compare Source

Fixed

• (napi) sync referred flag when creating a weak ThreadsafeFunction (#​3337)

Other

• (napi) outline non-generic core of ThreadsafeFunction::create (#​3334)

v3.9.2

Compare Source

Fixed

• (napi) ReadableStream Reader loses chunks and aborts on errored streams (#​3328)

v3.9.1

Compare Source

Fixed

• (napi) unify Reference finalize callbacks on Arc (Rc/Arc type confusion) (#​3313)
• (napi) zero-copy external strings, fix WASI double-free (#​3308)
• (napi) experimental node_api_create_object_with_properties (#​3304)

serde-rs/serde (serde)

v1.0.229

Compare Source

• Update to syn 3

toml-rs/toml (toml_edit)

v0.25.15

Compare Source

v0.25.14

Compare Source

v0.25.13

Compare Source

v0.25.12

Compare Source

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7acfc21d-7619-4b3e-b886-1838bf5ef5ad

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}