fix(deps): update rust crate napi to v3.12.7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
napi	dependencies	patch	=3.12.3 → =3.12.7

---

Release Notes

napi-rs/napi-rs (napi)

v3.12.7

Compare Source

Fixed

• (napi) guard AsyncTask completion against env teardown (#​3536)

v3.12.6

Compare Source

Fixed

• (cli) drain outstanding async work before disposing a WASI binding (#​3528)

v3.12.5

Compare Source

Fixed

• fatal_exception noop in optimized builds (#​3509)

v3.12.4

Compare Source

Security

• Object::unwrap and Object::remove_wrapped (and the deprecated Env::unwrap / Env::drop_wrapped) read a TypeId out of a payload that is not a TaggedObject, giving a heap out-of-bounds read and a JavaScript-forgeable out-of-bounds write; payload provenance is now validated before dereferencing. See GHSA-rhpj-pggq-896v, fixed in #​3506.
• The serde deserializer reached unreachable!() on ordinary JavaScript values and aborted the process instead of returning an error. See GHSA-f334-75xc-qxv3, fixed in #​3507.
• ArrayBuffer::from_external, TypedArraySlice::from_external and Uint8ClampedSlice::from_external (plus the compat-mode Env::create_arraybuffer_with_borrowed_data) built their slice from freed memory on runtimes without external buffers. See GHSA-32mm-r9wp-hrvc, fixed in #​3503.

Fixed

• (napi) return errors from the serde deserializer for unexpected JS value shapes (#​3507)
• (napi) validate wrapped payload provenance in Object::unwrap/remove_wrapped (#​3506)
• (napi) point from_external slices at the engine-owned copy after finalize reclaims the source (#​3503)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Cargo.lock

    Updating crates.io index
error: failed to select a version for `napi-build`.
    ... required by package `napi v3.12.7`
    ... which satisfies dependency `napi = "=3.12.7"` of package `ziwei-node v0.1.0 (/tmp/renovate/repos/github/matharts/ziwei/bindings/node)`
versions that meet the requirements `^2.4.4` are: 2.4.4

all possible versions conflict with previously selected packages

  previously selected package `napi-build v2.4.2`
    ... which satisfies dependency `napi-build = "=2.4.2"` of package `ziwei-node v0.1.0 (/tmp/renovate/repos/github/matharts/ziwei/bindings/node)`

failed to select a version for `napi-build` which could resolve this conflict