From 0b805afcfff861c8dec5f05a15d6a3d3d436685a Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 14 Jul 2026 11:16:01 +0000
Subject: [PATCH] fix(node): bump napi-rs to fix crash on concurrent
 response-body read errors (#498)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

napi-rs 3.8.4's ReadableStream pull-callback (used by ImpitResponse's
body streaming) could drop its resolver closure on a tokio worker
thread when the underlying stream yielded Err, releasing a
FunctionRef's V8 global handle off the JS thread. Under concurrent
body-read errors (e.g. simultaneous read timeouts) this raced V8's
GlobalHandles and crashed the process with SIGTRAP/SIGSEGV/SIGBUS.

Bumping napi to 3.10.5 (and napi-derive/napi-build to their matching
latest patch releases) resolves it — verified with the reporter's
concurrent-timeout repro (8/8 clean 30s runs at 5 workers, previously
crashing in ~1 of 5 runs).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Jom9tSWtRxejUjvo53QpU
---
 Cargo.lock            | 49 +++++++++++--------------------------------
 impit-node/Cargo.toml |  6 +++---
 2 files changed, 15 insertions(+), 40 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index aecc7e83..7ea2770c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -526,19 +526,9 @@ dependencies = [
 
 [[package]]
 name = "ctor"
-version = "0.8.0"
+version = "1.0.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "352d39c2f7bef1d6ad73db6f5160efcaed66d94ef8c6c573a8410c00bf909a98"
-dependencies = [
- "ctor-proc-macro",
- "dtor",
-]
-
-[[package]]
-name = "ctor-proc-macro"
-version = "0.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52560adf09603e58c9a7ee1fe1dcb95a16927b17c127f0ac02d6e768a0e25bc1"
+checksum = "fb22e947478ccf9dc44d8922042c677a63fbb88f2cb468521d1145816e5087cb"
 
 [[package]]
 name = "data-encoding"
@@ -611,21 +601,6 @@ dependencies = [
  "dtoa",
 ]
 
-[[package]]
-name = "dtor"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1057d6c64987086ff8ed0fd3fbf377a6b7d205cc7715868cd401705f715cbe4"
-dependencies = [
- "dtor-proc-macro",
-]
-
-[[package]]
-name = "dtor-proc-macro"
-version = "0.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f678cf4a922c215c63e0de95eb1ff08a958a81d47e485cf9da1e27bf6305cfa5"
-
 [[package]]
 name = "dunce"
 version = "1.0.5"
@@ -1657,9 +1632,9 @@ dependencies = [
 
 [[package]]
 name = "napi"
-version = "3.8.4"
+version = "3.10.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb7848c221fb7bb789e02f01875287ebb1e078b92a6566a34de01ef8806e7c2b"
+checksum = "6826e5ddc15589b2d68c8ad5321c18e85d40488e93e32962f362e572669bccf6"
 dependencies = [
  "bitflags",
  "ctor",
@@ -1675,15 +1650,15 @@ dependencies = [
 
 [[package]]
 name = "napi-build"
-version = "2.3.1"
+version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d376940fd5b723c6893cd1ee3f33abbfd86acb1cd1ec079f3ab04a2a3bc4d3b1"
+checksum = "c9c366d2c8c60b86fa632df75f745509b52f9128f91a6bad4c796e44abb505e1"
 
 [[package]]
 name = "napi-derive"
-version = "3.5.3"
+version = "3.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60867ff9a6f76e82350e0c3420cb0736f5866091b61d7d8a024baa54b0ec17dd"
+checksum = "b0fe526e81c105d3640516fcde83909dd1afe757c0d7a15af58830b5bc0fb9a1"
 dependencies = [
  "convert_case",
  "ctor",
@@ -1695,9 +1670,9 @@ dependencies = [
 
 [[package]]
 name = "napi-derive-backend"
-version = "5.0.2"
+version = "5.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0864cf6a82e2cfb69067374b64c9253d7e910e5b34db833ed7495dda56ccb18"
+checksum = "514281397bcddd9ea9a876c7a21a57bff2374237a000ca9a64ea0211ec1993e2"
 dependencies = [
  "convert_case",
  "proc-macro2",
@@ -1708,9 +1683,9 @@ dependencies = [
 
 [[package]]
 name = "napi-sys"
-version = "3.2.1"
+version = "3.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8eb602b84d7c1edae45e50bbf1374696548f36ae179dfa667f577e384bb90c2b"
+checksum = "73e43cf2eb0bd1bf95a43c07c076ebd2da5d1e015a71c3d201faeffffcc0ecac"
 dependencies = [
  "libloading",
 ]
diff --git a/impit-node/Cargo.toml b/impit-node/Cargo.toml
index dffeef9a..26c57945 100644
--- a/impit-node/Cargo.toml
+++ b/impit-node/Cargo.toml
@@ -7,8 +7,8 @@ version = "0.0.0"
 crate-type = ["cdylib"]
 
 [dependencies]
-napi = { version = "=3.8.4", default-features = false, features = ["napi4", "napi5", "async", "web_stream", "tokio_rt"] }
-napi-derive = "=3.5.3"
+napi = { version = "=3.10.5", default-features = false, features = ["napi4", "napi5", "async", "web_stream", "tokio_rt"] }
+napi-derive = "=3.5.10"
 impit = { path="../impit" }
 rustls = { version="0.23.36" }
 tokio = { version="1.41.1", features = ["full"] }
@@ -18,5 +18,5 @@ tokio-stream = "0.1.17"
 bytes = "1.11.1"
 
 [build-dependencies]
-napi-build = "2.1.4"
+napi-build = "2.3.2"