#1279 chore(deps): update dependency neon-cli to v0.10.1 Pull request opened by renovate[bot] This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | | ---------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [neon-cli](https://www.neon-bindings.com) ([source](https://redirect.github.com/neon-bindings/neon)) | [0.9.1 -> 0.10.1](https://renovatebot.com/diffs/npm/neon-cli/0.9.1/0.10.1) | [[age](https://camo.githubusercontent.com/d5cb2c290bb24116ed66df9cd684c9e01bb3e0ec36347f0426b805750730b463/68747470733a2f2f646576656c6f7065722e6d656e642e696f2f6170692f6d632f6261646765732f6167652f6e706d2f6e656f6e2d636c692f302e31302e313f736c696d3d74727565)](https://docs.renovatebot.com/merge-confidence/) | [[adoption](https://camo.githubusercontent.com/80909d7952c19e4c81749d8e0fce57bf6265aade160d2647ec25223f31dad809/68747470733a2f2f646576656c6f7065722e6d656e642e696f2f6170692f6d632f6261646765732f61646f7074696f6e2f6e706d2f6e656f6e2d636c692f302e31302e313f736c696d3d74727565)](https://docs.renovatebot.com/merge-confidence/) | [[passing](https://camo.githubusercontent.com/9b669b8ae22714fb6448e57e160f80c9b2b76d89f684b003bdd1844ccdad7f13/68747470733a2f2f646576656c6f7065722e6d656e642e696f2f6170692f6d632f6261646765732f636f6d7061746962696c6974792f6e706d2f6e656f6e2d636c692f302e392e312f302e31302e313f736c696d3d74727565)](https://docs.renovatebot.com/merge-confidence/) | [[confidence](https://camo.githubusercontent.com/0d9211d10f41a7a1f0084abfca8b27c14350b8f76e0444128d15f84f7e05594e/68747470733a2f2f646576656c6f7065722e6d656e642e696f2f6170692f6d632f6261646765732f636f6e666964656e63652f6e706d2f6e656f6e2d636c692f302e392e312f302e31302e313f736c696d3d74727565)](https://docs.renovatebot.com/merge-confidence/) | --- Release Notes neon-bindings/neon (neon-cli) `v0.10.1` Compare Source Fix a soundness hole in

JsArrayBuffer::external

and

JsBuffer::external

(https://github.com/neon-bindings/neon/pull/897). Thanks to @​Cassy343 for finding the issue! In previous versions of Neon, it was possible to create a

JsArrayBuffer

or

JsBuffer

that references data without the

'static

lifetime. pub fn soundness_hole(mut cx: FunctionContext) -> JsResult<JsArrayBuffer> { let mut data = vec![0u8, 1, 2, 3]; // Creating an external from

&mut [u8]

instead of

Vec<u8>

since there is a blanket impl // of

AsMut<T> for &mut T

let buf = JsArrayBuffer::external(&mut cx, data.as_mut_slice()); //

buf

is still holding a reference to

data

! drop(data); Ok(buf) } `v0.10.0` Compare Source See the <MIGRATION_GUIDE_0.10.md|Neon 0.10 Migration Guide> for more details about new features and breaking changes. Features • New buffer borrowing API • Added JoinHandle for

Channel::send

• `JsPromise` and `TaskBuilder` • Handle panics and exceptions in Channels and Tasks • Function call / construct builders and simplify low level call • Create functions from closures Minor Improvements • Performance improvements • Rename N-API to Node-API in docs to match Node changes • Remove unused cslice dependency • Switch to `syn-mid` for faster compile times • Downcast in `Object::get` • Added migration guide • Added `Object::get_opt` and `Object::get_value` Fixes • [Safety] Make it harder to store and forge Throw • [Soundness] Make `JsValue` types `!Copy` • [Soundness] Tag `Root` with instance id •

create-neon

no longer leaves partial project on disk • Fix legacy backend on Electron and Windows • FreeBSD support on legacy backend *Internal Improvem… pact-foundation/pact-js ✅ All checks have passed 24/24 successful checks