Update Rust crate neon to v1 - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
neon (source)	dependencies	major	0.10 -> 1.0

---

Release Notes

neon-bindings/neon (neon)

v1.0.0

Compare Source

Commitment to Compatibility

The release of Neon 1.0 marks our commitment to backwards-compatibility: starting with 1.0.0, Neon users can be confident that future upgrades to Neon 1.x versions should never require code changes (with the possible exception of safety bugfixes, which we expect to be rare). We also do not anticipate releasing new major versions often and do not have any plans to do so for now.

Breaking Changes

• Remove the generic parameter from JsFunction (https://github.com/neon-bindings/neon/pull/989)
• JsArray::new takes a usize instead of a u32 (https://github.com/neon-bindings/neon/pull/988)
• Made Context::global read a key and added Context::global_object (https://github.com/neon-bindings/neon/pull/987)
• Deprecated feature flags were removed

Bug fixes

• Fix unhandledRejection with JsPromise::to_future (https://github.com/neon-bindings/neon/pull/1008)
• Typo in cargo-cp-artifact help (https://github.com/neon-bindings/neon/pull/998)
• Typo in README (https://github.com/neon-bindings/neon/pull/1012)

Other

https://github.com/neon-bindings/neon/pull/1010

• Relaxed error behavior on missing Node-API symbols. Neon will panic on first use instead of aborting the process at module load time.
• Bumped dependency versions
• Changed to edition 2021
• Updated support matrix to Node 18, 20, and 21

v0.10.1

Compare Source

Fix a soundness hole in JsArrayBuffer::external
and JsBuffer::external (https://github.com/neon-bindings/neon/pull/897).

Thanks to @​Cassy343 for finding the issue!

In previous versions of Neon, it was possible to create a JsArrayBuffer or JsBuffer that references data without the 'static lifetime.

pub fn soundness_hole(mut cx: FunctionContext) -> JsResult<JsArrayBuffer> {
    let mut data = vec![0u8, 1, 2, 3];

    // Creating an external from `&mut [u8]` instead of `Vec<u8>` since there is a blanket impl
    // of `AsMut<T> for &mut T`
    let buf = JsArrayBuffer::external(&mut cx, data.as_mut_slice());

    // `buf` is still holding a reference to `data`!
    drop(data);

    Ok(buf)
}

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.