Bump neon-cli from 0.8.3 to 0.10.1

[dependabot]

Bumps neon-cli from 0.8.3 to 0.10.1.

Release notes

Sourced from neon-cli's releases.

v0.10.1

Fix a soundness hole in JsArrayBuffer::external and JsBuffer::external (neon-bindings/neon#897).

Thanks to @​Cassy343 for finding the issue!

In previous versions of Neon, it was possible to create a JsArrayBuffer or JsBuffer that references data without the 'static lifetime.

pub fn soundness_hole(mut cx: FunctionContext) -> JsResult<JsArrayBuffer> {
    let mut data = vec![0u8, 1, 2, 3];
// Creating an external from `&amp;mut [u8]` instead of `Vec&lt;u8&gt;` since there is a blanket impl
// of `AsMut&lt;T&gt; for &amp;mut T`
let buf = JsArrayBuffer::external(&amp;mut cx, data.as_mut_slice());
// buf is still holding a reference to data!
drop(data);
Ok(buf)

}

v0.10.0

See the Neon 0.10 Migration Guide for more details about new features and breaking changes.

Features

• New buffer borrowing API
• Added JoinHandle for Channel::send
• JsPromise and TaskBuilder
• Handle panics and exceptions in Channels and Tasks
• Function call / construct builders and simplify low level call
• Create functions from closures

Minor Improvements

• Performance improvements
• Rename N-API to Node-API in docs to match Node changes
• Remove unused cslice dependency
• Switch to syn-mid for faster compile times
• Downcast in Object::get
• Added migration guide
• Added Object::get_opt and Object::get_value

Fixes

• [Safety] Make it harder to store and forge Throw
• [Soundness] Make JsValue types !Copy

... (truncated)

Changelog

Sourced from neon-cli's changelog.

Version 0.10.1

Fix a soundness hole in JsArrayBuffer::external and JsBuffer::external (neon-bindings/neon#897).

Thanks to @​Cassy343 for finding the issue!

In previous versions of Neon, it was possible to create a JsArrayBuffer or JsBuffer that references data without the 'static lifetime.

pub fn soundness_hole(mut cx: FunctionContext) -> JsResult<JsArrayBuffer> {
    let mut data = vec![0u8, 1, 2, 3];
// Creating an external from `&amp;mut [u8]` instead of `Vec&lt;u8&gt;` since there is a blanket impl
// of `AsMut&lt;T&gt; for &amp;mut T`
let buf = JsArrayBuffer::external(&amp;mut cx, data.as_mut_slice());
// buf is still holding a reference to data!
drop(data);
Ok(buf)

}

Version 0.10

See the Neon 0.10 Migration Guide for more details about new features and breaking changes.

Features

• New buffer borrowing API
• Added JoinHandle for Channel::send
• JsPromise and TaskBuilder
• Handle panics and exceptions in Channels and Tasks
• Function call / construct builders and simplify low level call
• Create functions from closures

Minor Improvements

• Performance improvements
• Rename N-API to Node-API in docs to match Node changes
• Remove unused cslice dependency
• Switch to syn-mid for faster compile times
• Downcast in Object::get
• Added migration guide
• Added Object::get_opt and Object::get_value

Fixes

... (truncated)

Commits

• c17014e Merge pull request #899 from neon-bindings/kv/fix-external-soundness
• 9fa8768 Neon 0.10.1
• 4e350ea soundness(neon): Require T: 'static on JsArrayBuffer::external and `JsBuf...
• 779f733 Merge pull request #870 from neon-bindings/kv/0.10-release
• 29d8f21 neon 0.10 and create-neon 0.2
• b386ec2 Merge pull request #868 from neon-bindings/migration-guide-get-union-types
• f3b7eb5 Delete stray semicolons
• d6196dc Migration guide entry for Object::get_value() and Object::get_opt().
• f942e99 Merge pull request #867 from neon-bindings/object-get-conveniences
• 9baa676 Doc comments
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)