chore: bump up all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
indexmap	workspace.dependencies	patch	2.14.0 → 2.14.2
napi	workspace.dependencies	minor	3.11.0 → 3.12.4
napi-build	workspace.dependencies	minor	2.3.2 → 2.4.2
napi-derive	workspace.dependencies	patch	3.6.0 → 3.6.5
oxc_allocator (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_ast (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_codegen (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_data_structures (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_diagnostics (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_ecmascript (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_parser (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_semantic (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_span (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_str (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_syntax (source)	workspace.dependencies	minor	0.141 → 0.149
oxc_traverse (source)	workspace.dependencies	minor	0.141 → 0.149
thiserror	workspace.dependencies	patch	2.0.19 → 2.0.20

---

Release Notes

indexmap-rs/indexmap (indexmap)

v2.14.2

Compare Source

• Fix item hygiene in map and set macros. Previously, an internal const CAP
  could shadow the same name in the caller's namespace.
• Allow const initialization of empty indexmap_with_default! and
  indexset_with_default!. The hasher may also be omitted if it's inferrable.

v2.14.1

Compare Source

• Simplify comparisons where Equivalent isn't needed (Q = K).
• Unify index assertions for bounds checks.
• Fix (or expect) clippy lints.

napi-rs/napi-rs (napi)

v3.12.4

Compare Source

Security

• Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #​3506.
• The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #​3507.
• ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #​3503.

Fixed

• (napi) return errors from the serde deserializer for unexpected JS value shapes (#​3507)
• (napi) validate wrapped payload provenance in Object::unwrap/remove_wrapped (#​3506)
• (napi) point from_external slices at the engine-owned copy after finalize reclaims the source (#​3503)

v3.12.3

Compare Source

Fixed

• CurrentThread waker-stack deadlocks and threadless-wasm Buffer detachment (#​3489)
• (napi) catch panics in closure trampolines instead of aborting (#​3473)

Other

• (napi) keep anyhow error cause when converting (#​3477)
• (napi) outline threadsafe callback dispatch (#​3465)
• (napi) outline class instance construction (#​3464)

v3.12.2

Compare Source

Fixed

• (napi) memory safety in PromiseRaw callbacks and AbortSignal conversion (#​3458)

v3.12.1

Compare Source

Fixed

• (napi) stop unloading addons with live native code, preserve non-Error rejections, and add the wasm teardown barrier (#​3423)
• (wasi) avoid randomness during module registration (#​3447)

v3.12.0

Compare Source

Added

• (cli) support non-threaded WASI targets (#​3353)

dtolnay/thiserror (thiserror)

v2.0.20

Compare Source

• Suppress redundant_field_names clippy lint in generated code (#​454)

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 12:00 AM and 04:59 AM, Monday through Wednesday (* 0-4 * * 1-3)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.