neon-runtime

Fix a soundness hole in JsArrayBuffer::external
and JsBuffer::external (#897).

Thanks to @Cassy343 for finding the issue!

In previous versions of Neon, it was possible to create a JsArrayBuffer or JsBuffer that references data without the 'static lifetime.

pub fn soundness_hole(mut cx: FunctionContext) -> JsResult<JsArrayBuffer> {
    let mut data = vec![0u8, 1, 2, 3];

    // Creating an external from `&mut [u8]` instead of `Vec<u8>` since there is a blanket impl
    // of `AsMut<T> for &mut T`
    let buf = JsArrayBuffer::external(&mut cx, data.as_mut_slice());

    // `buf` is still holding a reference to `data`!
    drop(data);

    Ok(buf)
}

Fix a soundness hole in JsArrayBuffer::external and JsBuffer::external (https://github.com/neon-bindings/neon/pull/897).

Thanks to @Cassy343 for finding the issue!

In previous versions of Neon, it was possible to create a JsArrayBuffer or JsBuffer that references data without the 'static lifetime.

pub fn soundness_hole(mut cx: FunctionContext) -> JsResult<JsArrayBuffer> {
    let mut data = vec![0u8, 1, 2, 3];

    // Creating an external from `&mut [u8]` instead of `Vec<u8>` since there is a blanket impl
    // of `AsMut<T> for &mut T`
    let buf = JsArrayBuffer::external(&mut cx, data.as_mut_slice());

    // `buf` is still holding a reference to `data`!
    drop(data);

    Ok(buf)
}

• Expose the Finalize trait as neon::types::Finalize so that docs are visible
• Improved docs and build scripts in create-neon to make release builds more discoverable (https://github.com/neon-bindings/neon/pull/771)
• Update nan to fix an Electron 13 incompatibility (https://github.com/neon-bindings/neon/pull/778)

Performance

Channel, formerly EventQueue, are now cloneable. Clones share a backing queue to take advantage of an optimization in Node threadsafe functions. Additionally, when specifying Node API 6 or higher (napi-6), calling cx.channel() will return a shared queue (https://github.com/neon-bindings/neon/pull/739).

The change may cause a performance regression in some pathological use cases (https://github.com/neon-bindings/neon/issues/762).

Deprecation

EventQueue and EventQueueError have been renamed to Channel and ChannelError respectively to clarify their function and similarity to Rust channels. The types are available as deprecated aliases (https://github.com/neon-bindings/neon/pull/752).

Docs

• Document error causes for Channel::try_send docs (https://github.com/neon-bindings/neon/pull/767)
• Document neon::object (https://github.com/neon-bindings/neon/pull/740)

Fixes

• Fix usage of a removed API in legacy buffers (https://github.com/neon-bindings/neon/pull/769)

• Fix crash caused by non-thread safety in napi_threadsafefunction on early termination (https://github.com/neon-bindings/neon/pull/744)
• Fix memory leak in Root (https://github.com/neon-bindings/neon/pull/750)

• More docs improvements
• Added a deprecation warning to neon new (https://github.com/neon-bindings/neon/pull/722)

• Fix legacy-backend for Node 16 (https://github.com/neon-bindings/neon/pull/715)
• Various docs improvements

Fixes

• as_slice and as_mut_slice properly handle a null pointer from an empty buffer (https://github.com/neon-bindings/neon/pull/681)
• Global drop queue added to avoid panics on N-API 6+ when dropping a Root (https://github.com/neon-bindings/neon/pull/700)

Features

• Added neon::reflect::eval (https://github.com/neon-bindings/neon/pull/692)
• Added create-neon for creating an N-API project (https://github.com/neon-bindings/neon/pull/690)
• Added details to the README.md generated by create-neon (https://github.com/neon-bindings/neon/pull/697)

Improvements

• Switched N-API tests to cargo-cp-artifact (https://github.com/neon-bindings/neon/pull/687)
• Added impl<T: Finalize> Finalize for Option<T> (https://github.com/neon-bindings/neon/pull/680)
• Added a N-API migration guide (https://github.com/neon-bindings/neon/pull/685)

Housekeeping

• Lint fixes (https://github.com/neon-bindings/neon/pull/609)
• Lint CI enforcement and cargo fmt (https://github.com/neon-bindings/neon/pull/698)

Features

• Added JsDate to N-API backend (https://github.com/neon-bindings/neon/pull/639)
• Implement JsBuffer::unitialized for N-API backend (https://github.com/neon-bindings/neon/pull/664)

Fixes

• Do not panic if a Root is leaked after the event loop has stopped (https://github.com/neon-bindings/neon/pull/677)
• Stubs for features that will not be implemented in the N-API backend are removed (https://github.com/neon-bindings/neon/pull/663)
• Fix doc URL link (https://github.com/neon-bindings/neon/pull/663)

N-API

Version Selection

Neon supports a large number of different Node versions which may have different N-API requirements. Neon now supports selecting the minimum required N-API version required by a module. For example, for N-API Version 4:

neon = { version = "0.7", default-features = false, features = ["napi-4"] }

If the Neon module is loaded in an older version of Node that does not support that N-API version, a panic message will inform the user.

Threadsafe Functions

A prerelease version of EventQueue for calling into the main JavaScript thread from Rust threads can be enabled with the event-queue-api feature flag. The API is considered unstable and may change in the future until the RFC is merged.

The cx.try_catch(..) API has been updated to return T: Sized instead of T: Value (https://github.com/neon-bindings/neon/pull/631). This API is strictly more powerful and allows users to return both JavaScript and Rust values from try_catch closures.

N-API

• N-API symbols are now loaded dynamically (https://github.com/neon-bindings/neon/pull/646)
• Build process for N-API is greatly simplified by leveraging dynamic loading (https://github.com/neon-bindings/neon/pull/647)

Bug Fixes

Upgrade node-gyp (https://github.com/neon-bindings/neon/pull/623)

• Fix Windows Node 15
• Fix Apple M1

Features

Added neon::main macro as a replacement for register_module! (https://github.com/neon-bindings/neon/pull/636)

Known Issues

Builds occassionally fail with Windows, Node 15 and npm 7 (https://github.com/neon-bindings/neon/issues/642)

CLI

Added support for additional arguments passed to cargo build. Resolves https://github.com/neon-bindings/neon/issues/471.

neon build --release -- --features awesome

N-API

• Improved arguments performance
• Add redirect and NPM_CONFIG_DISTURL support

Performance

• smallvec is used for collecting arguments and yields a small performance gain when calling JsFunction

Broader Support

Thanks to @staltz, neon now builds for both iOS and Android with nodejs-mobile.

Re-publish

Versions 0.4.1 and 0.4.2 included a breaking change in neon-runtime. At the time, this was considered acceptable because neon-runtime is considered an internal crate and not part of the public API. However, it was discovered, after publishing, that neon-serde, a commonly used crate in the neon ecosystem, contained a direct dependency on neon-runtime. In order to best support users, versions 0.4.1 and 0.4.2 were "yanked" and re-published as 0.5.0.

Additionally, the team is working with the authors of neon-serde to remove the dependency on neon-runtime to prevent future issues.

Bug Fixes

• Fix stack overflow in DowncastError Display impl (https://github.com/neon-bindings/neon/pull/606)

Unpublished / Yanked

Bug Fixes

• Fix memory leak and race condition in EventHandler

Unpublished / Yanked

Features

Try Catch

Added the cx.try_catch API of RFC 29. This feature is behind the try-catch-api feature flag.

Bug Fixes

• Pass async_context to node::MakeCallback (https://github.com/neon-bindings/neon/pull/498)
• Cache bust neon if node version changes (https://github.com/neon-bindings/neon/pull/388)
• Fix debug builds in windows (https://github.com/neon-bindings/neon/pull/400)
• Fix cross compiling architectures (https://github.com/neon-bindings/neon/pull/491)
• Fix neon new hanging on Windows (https://github.com/neon-bindings/neon/pull/537)

CI Improvements

The Neon Project now uses Github Actions thanks to @lhr0909! As part of this change, CI now runs on all of our supported platforms (macOS, Windows, linux) and Node versions.

Hot fix for neon build in projects with many dependencies.

Bug fixes and Small Features

• Disable node module registration on test build, allowing cargo test to be used on neon modules
• Added support for alternate CARGO_TARGET_DIR locations (e.g., workspaces)
• Added macros to neon::prelude to improve ergonomics in Rust 2018
• Link win_delay_hook when building with electron-build-env, fixing Windows Electron
• Fixed missing __cxa_pure_virtual on Linux
• Copy native files into OUT_DIR and build there to fix cargo publish and follow best practices
• Eliminated mem::uniitialized() usage, reducing warnings and fixing an instance of undefined behavior

Potentially Breaking

The macOS link arguments were moved from neon-cli to neon-build. This is more idiomatic, but makes neon-build required for macOS builds where it was unnecessary before.

Since neon-build has been included in the project template since 0.1 this change was not deemed significant enough to warrant a major revision.

N-API

Neon 0.3.2 lays the groundwork for the next major revision. Development of Neon against an ABI stable Node API (N-API) will occur on main.

• Added legacy-runtime and n-api feature flags for toggling neon runtime
• Moved the legacy runtime to nodejs-sys crate
• Stubbed required n-api implementation
• Added feature flag to neon-cli to help configuring n-api projects

• Build v0.3 project templates by default in the CLI

• Optimization in Scope structures, thanks to @maciejhirsz (#282)
• Fixed a memory leak in the Task API, thanks to @kjvalencik (#291)
• Add support for Node 10, thanks to @mhsjlw and @nomadtechie (#314)

• Reinstate JsInteger (although it's deprecated) for now, to be removed in 0.2. (#279)

• Fix a bug that was causing annoying unnecessary rebuilds (#242).
• New API for getting the global object (#249).

• Background task API (#214).
• Fixes to Windows builds (#221, #227), thanks to @hone's tenacious troubleshooting.

• TypeScript upgrade fixes (neon-bindings/neon-cli#62, neon-bindings/neon-cli#65).

• CLI bugfix (neon-bindings/neon-cli#59).
• JsArrayBuffer (#210).

• CLI bugfix (neon-bindings/neon-cli#57).

• CLI bugfix (neon-bindings/neon-cli#56).

• Better Electron support in CLI's build process.
• Better support for Electron via the artifacts file (neon-bindings/neon-cli#52).

• Ensure failing tests break the build (#191)
• Catch Rust panics and convert them to JS exceptions (#192)
• Implement Error for Throw (#201)
• Clean up the CLI and allow neon build to optionally take module names (neon-bindings/neon-cli#48).

• More robust build scripts for neon-runtime, fixing Homebrew node installations (see #189)

• Optimized rooting protocol
• Eliminate rustc warnings
• Lots of internal API docs
• Windows support! :tada:
• Renamed neon-sys to neon-runtime
• Depend on neon-build as a build dependency (see neon-bindings/neon-cli#46).