chore(deps): Bump rquickjs from 0.12.2 to 0.13.0 in /src/sandbox/runtime

[dependabot]

Bumps rquickjs from 0.12.2 to 0.13.0.

Changelog

Sourced from rquickjs's changelog.

[0.13.0] - 2026-09-07

Breaking Changes

• TypedArray::as_bytes, ArrayBuffer::as_bytes and ArrayBuffer::as_slice are now unsafe fn, and the unsound safe AsRef<[T]> impls for TypedArray and ArrayBuffer were removed in favor of the new unsafe fn TypedArray::as_slice #736
• TypedArray::as_raw and ArrayBuffer::as_raw now return NonNull<[u8]> slice pointers, and the unnameable RawArrayBuffer type has been removed.

Added

• Add pre-generated bindings for riscv64gc-unknown-linux-gnu and riscv64a23-unknown-linux-gnu
• ArrayBuffer::new-backed buffers now support ArrayBuffer.prototype.transfer to a different length instead of always failing

Fixed

• Fixed deadlock when dropping a Context while the runtime lock is held under the parallel feature
• Updated sys/quickjs to 2c620e4 (quickjs-ng 0.16.2) and adapted ArrayBuffer callbacks to the new JSReallocArrayBufferDataFunc contract
• Removed stale RefCountHeader cast in drop_context (field moved to allocator header in quickjs-ng)

Security

• Fixed TypedArray/ArrayBuffer byte-slice accessors returning a safe &[u8] that could be mutated, detached or reallocated by JS running while the slice was still borrowed #736

Commits

• f3039c8 Release 0.13.0 (#742)
• 9ecaf2c Update quickjs-ng to 2c620e4 and fix ArrayBuffer for new JS_NewArrayBuffer si...
• 4e5dd34 Deduplicate C string construction in Exception methods (#740)
• 761f4e3 Replace RawArrayBuffer with NonNull<[u8]> (#738)
• e54cde1 Fix Class::get_cell/get_class_cell lifetimes (#739)
• 3e2ccbc Fix deadlock when dropping a Context while the runtime lock is held (#724)
• 3f634bd Update native module examples to the current module macro (#731)
• 5e9a7ba Merge pull request #737 from richarddd/fix/typed-array-as-bytes-aliasing
• c2127ff Merge pull request #733 from stevefan1999-personal/patch-i686-msvc-unaligned-bug
• 1f21606 Merge pull request #734 from DelSkayn/dependabot/cargo/convert_case-0.12
• Additional commits viewable in compare view