GHSA-8mj7-wxmc-f424 Use after free in Neon external buffers

• crates.io neon: >= 0.8.0, < 0.10.1 → fixed in 0.10.1

Neon provides functionality for creating JavaScript `ArrayBuffer` (and the `Buffer` subtype) instances backed by bytes allocated outside of V8/Node. The `JsArrayBuffer::external` and `JsBuffer::external` did not require `T: 'static` prior to Neon `0.10.1`. This allowed creating an externally backed buffer from types that may be freed while they are still referenced by a JavaScript `ArrayBuffer`. The following example demonstrates use after free. It compiles on versions ` JsResult { let mut data = vec![0u8, 1, 2, 3]; // Creating an external from `&mut [u8]` instead of `Vec` since there is a blanket impl // of `AsMut for &mut T` let buf = JsArrayBuffer::external(&mut cx, data.as_mut_slice()); // `buf` is still holding a reference to `data`! drop(data); Ok(buf) } ```