Bump @napi-rs/cli from 2.18.4 to 3.10.5 in /node-attestation-bindings

[dependabot]

Bumps @napi-rs/cli from 2.18.4 to 3.10.5.

Release notes

Sourced from @​napi-rs/cli's releases.

@​napi-rs/cli@​3.9.1

Patch over 3.9.0.

Fixes

• WASI threads builds on current toolchains (#3492) wasm32-wasip1-threads was failing in two ways: wasi-sdk 34 changed the futex ABI, and Rust nightly started linking crt1-reactor.o itself (duplicate _initialize). The CLI now picks the matching emnapi archive; the build crate stops double-linking _initialize.

• WASI on Android / Termux (#3485) Generated Node loaders preopened /, which Termux cannot open (UVWASI_EACCES). Android now preopens the current working directory. Other platforms are unchanged.

• Generated files share one format (#3501) JSON / TOML / YAML, .d.ts, and JS / WASI loaders now use one house style (indent, trailing newline, quotes). Regenerating bindings may produce noisy diffs with no behavior change.

Deps

• js-yaml 4 → 5 (#3344) — YAML dump formatting can change; loaded values should not.

Same-day packages

Package	Version
@napi-rs/triples	2.1.23
@napi-rs/wasm-runtime	1.2.4

@​napi-rs/cli@​3.7.1

What's Changed

• fix: receive error message from worker correctly by @​sapphi-red in napi-rs/napi-rs#3300
• chore(deps): update dependency npm-run-all2 to v9 by @​renovate[bot] in napi-rs/napi-rs#3299
• fix(cli): NAPI_RS_FORCE_WASI only activates on 'true' or 'error' by @​MukundaKatta in napi-rs/napi-rs#3236

New Contributors

• @​MukundaKatta made their first contribution in napi-rs/napi-rs#3236

Full Changelog: https://github.com/napi-rs/napi-rs/compare/napi-v3.9.0...@​napi-rs/cli@3.7.1

@​napi-rs/cli@​3.6.2

What's Changed

• build(deps): bump basic-ftp from 5.2.0 to 5.2.1 by @​dependabot[bot] in napi-rs/napi-rs#3203
• fix(deps): update rust crate ctor to v0.9.1 by @​renovate[bot] in napi-rs/napi-rs#3204
• fix(cli): parallelize type definition generation deterministically by @​trivikr in napi-rs/napi-rs#3205
• fix(deps): disable ctor priority feature by @​Brooooooklyn in napi-rs/napi-rs#3209
• fix(cli): preserve existing optionalDependencies in pre-publish by @​trivikr in napi-rs/napi-rs#3207
• fix(cli): preserve stricter node engine ranges in WASI package generation by @​trivikr in napi-rs/napi-rs#3201
• build(deps): bump basic-ftp from 5.2.1 to 5.2.2 by @​dependabot[bot] in napi-rs/napi-rs#3212
• fix(cli): resolve absolute packageJsonPath in universalize by @​trivikr in napi-rs/napi-rs#3210
• fix(cli): compatible with latest wasi-sdk toolchain by @​Brooooooklyn in napi-rs/napi-rs#3217
• fix(cli): fail build when --pipe post-process command exits non-zero by @​trivikr in napi-rs/napi-rs#3218
• chore(deps): update cross-platform-actions/action action to v1 by @​renovate[bot] in napi-rs/napi-rs#3220
• fix(deps): update rust crate ctor to v0.10.0 by @​renovate[bot] in napi-rs/napi-rs#3224

... (truncated)

Commits

• 5ae5cf6 chore(release): publish
• 0da138e feat(cli): self-sign OpenHarmony artifacts with --ohos-sign (#3539)
• 2499a63 feat(async-runtime): offer the MultiThread flavor on wasm32-wasip1-threads (#...
• 886bd07 chore(deps): update dependency oxc-parser to ^0.151.0 (#3542)
• edb0a29 fix(napi): validate native payload provenance for External and instance data ...
• 38162bb chore: release (#3529)
• ec3d8ea fix(napi): guard AsyncTask completion against env teardown (#3536)
• 96ed267 chore(deps): update release-plz/action action to v0.5.139 (#3537)
• b2c9f3b chore(deps): update release-plz/action action to v0.5.138 (#3533)
• f31c887 fix(cli): skip the reconciliation heal test on hosts whose identity probes fa...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​napi-rs/cli since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​napi-rs/​cli@​2.18.4 ⏵ 3.10.5			-1	+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	License policy violation: npm argparse under Python-2.0.1 License: Python-2.0.1 - The applicable license policy does not permit this license (5) (package/LICENSE) From: node-attestation-bindings/package.json → npm/@napi-rs/cli@3.10.5 → npm/argparse@2.0.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/argparse@2.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	License policy violation: npm typescript under CC-BY-4.0 License: CC-BY-4.0 - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: MIT-Khronos-old - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt) From: node-attestation-bindings/package.json → npm/@napi-rs/cli@3.10.5 → npm/typescript@6.0.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@6.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report