Bump the all-dependencies group with 2 updates

[dependabot]

Updated Jint from 4.16.4 to 4.17.0.

Release notes

Sourced from Jint's releases.

4.17.0

Jint 4.17.0 is a release from the 4.x branch. It backports correctness and conformance fixes from main (four of them for scripts that could end the host process), linear string building, and two new opt-in APIs for hosts. That is why it is a minor release rather than a patch. Nothing in it changes an existing API or an existing default, so it is a drop-in update from 4.16.4.

Highlights

A pooled engine can let go of a finished request's objects. Hosts that reuse one engine across many evaluations (CaptureGlobalSnapshot once, RestoreGlobalSnapshot between runs) keep the interpreter's warmed caches, and that is the point of reusing it. But a warmed call site remembers the last function it called, and a warmed member read remembers the last object it read from. In a pooled web host, that can be a delegate built from a finished request's services, which then stay alive until the same script runs again. The new Engine.Advanced.DiscardInterpreterCaches() drops those caches, so the objects can be collected. The engine, its intrinsics and its global object stay as they are. The next run of each script rebuilds its cache, which costs roughly what a first run on a new engine costs, minus building the engine. A good place to call it is when an engine has been idle for a while, rather than after every use (#​4229, from #​4227).

A host can carry its own state across await. Jint now runs ECMAScript's HostMakeJobCallback and HostCallJobCallback steps for every promise reaction, every thenable job and the FinalizationRegistry cleanup callback. A host can take part through the new Options.Host.JobCallbacks, which accepts a JobCallbackHooks with Capture, Enter and Exit callbacks. That lets each branch of a Promise.all fan-out keep its own host context, such as a logging scope or ambient request data, through every await (#​4231, from #​4230; issue #​4200). The default is no hooks, in which case each promise registration costs one null check and nothing a script can observe changes.

Four more ways for a script to end the host process are closed.

• ShadowRealm. A failure crossing a ShadowRealm boundary threw its TypeError copy from inside the catch that was handling the original failure. That added a nested exception dispatch at every hop, and no stack check could see it. Even with the stack-overflow guard on, a long chain of wrapped functions ended the process on the way back out, and a three-line script with a name getter needed no chain at all. Building that copy also ran script (toString, getters, proxy traps); it no longer does. A failed importValue now reports the import failure instead of an unrelated error (#​4220, from #​4176 and #​4183).
• instanceof and eval. instanceof now checks the native stack before calling a custom Symbol.hasInstance method, and eval checks it before parsing. A self-referencing Symbol.hasInstance, or var s = 'eval(s)'; eval(s), now raises a RangeError the script can catch instead of ending the process. On the MaxExecutionStackCount path, eval also stopped hopping to a new thread at each overflow without ever throwing. instanceof over a bound function now consults every bound link's own Symbol.hasInstance, as the specification requires (#​4221, from #​4172, #​4184 and #​4187).
• These checks follow 4.x's existing rule. Like every other stack check on 4.x, they are active only when Options.Constraints.StackOverflowGuard is on, so turn it on for any script you do not fully trust.

Building a string with s = s + x is linear. A + whose result reaches 512 characters now produces a deferred string instead of copying both sides. Building with s = s + x, s = x + s and s = s + a + b therefore becomes linear, as s += x already was. Short concatenations take a separate path and pay nothing for this. The deferred string is safe to read from several engines that share one Prepared<Script>, and it is charged to LimitMemory when it is built, so a memory limit still bounds it. Binding an already-bound function also no longer copies its whole "bound …" name at every level (#​4160, from #​3386, #​3571, #​4130, #​4164 and #​4173).

Array.prototype.concat spreads host arrays and lists. Since 4.14, CLR arrays and lists reach script as live views by default. concat added such a view as a single element instead of spreading its items, so a.concat(b) returned the two wrappers. It now spreads anything script sees as an array (#​4219, from #​4216; issue #​4201).

TypedArray.prototype.with survives a shrinking coercion. When converting the index or the value made a resizable buffer shorter, with copied past its new end and let a CLR ArgumentException escape. It now copies only what the buffer still holds (#​4218, from #​4157).

Verification

Every backport was verified failing-first: its tests were run against the unfixed 4.x tree on .NET 10 and .NET Framework 4.7.2, then with the change. The release candidate was measured against 4.16.4 on SunSpider and Dromaeo in six paired rounds, alternating which build ran first in each round. The four Dromaeo ObjectRegExp rows ran 12–15% faster and SunSpider's 3d-raytrace 2.3% faster. No row regressed by 1% or more; the two rows whose interval did not include zero (one Dromaeo Cube variant, +0.70%, and SunSpider's controlflow-recursive, +0.88%) are within this machine's run-to-run noise.

What's Changed

• Backport culture-independent overload-scoring fixture to 4.x by @​PrzemyslawKlys in Backport culture-independent overload-scoring fixture to 4.x sebastienros/jint#4215
• Backport #​4216 to 4.x: make Array.prototype.concat spread host arrays and lists by @​lahma in Backport #4216 to 4.x: make Array.prototype.concat spread host arrays and lists sebastienros/jint#4219
• Backport #​4176, #​4183 to 4.x: keep a ShadowRealm failure copy from killing the host or running script by @​lahma in Backport #4176, #4183 to 4.x: keep a ShadowRealm failure copy from killing the host or running script sebastienros/jint#4220
• Backport #​3386, #​3571, #​4130, #​4164 and #​4173 to 4.x: linear string building, safe across engines and charged to LimitMemory by @​lahma in Backport #3386, #3571, #4130, #4164 and #4173 to 4.x: linear string building, safe across engines and charged to LimitMemory sebastienros/jint#4160
• Backport #​4172, #​4184, #​4187 to 4.x: stop instanceof and eval recursions from killing the host by @​lahma in Backport #4172, #4184, #4187 to 4.x: stop instanceof and eval recursions from killing the host sebastienros/jint#4221
• Backport #​4157 to 4.x: Fix TypedArray.prototype.with after a shrinking coercion by @​lahma in Backport #4157 to 4.x: Fix TypedArray.prototype.with after a shrinking coercion sebastienros/jint#4218
• Backport #​4227 to 4.x: Let a reused engine discard the host objects its warmed caches hold by @​lahma in Backport #4227 to 4.x: Let a reused engine discard the host objects its warmed caches hold sebastienros/jint#4229
• Backport #​4230 to 4.x: Let a host carry its own state across await through HostMakeJobCallback by @​lahma in Backport #4230 to 4.x: Let a host carry its own state across await through HostMakeJobCallback sebastienros/jint#4231

Full Changelog: sebastienros/jint@v4.16.4...v4.17.0

Commits viewable in compare view.

Updated NUglify from 1.23.3 to 1.23.4.

Release notes

Sourced from NUglify's releases.

1.23.4

What's Changed

• Fix trailing commas in arrow function parameter lists by @​jbest84 in Fix trailing commas in arrow function parameter lists jbest84/NUglify#478

Full Changelog: jbest84/NUglify@v1.23.3...v1.23.4

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Maintenance
  • Updated internal components. No changes to user-facing features or behavior are included in this release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1256c877-978a-43ea-9694-19345abd16af

📥 Commits

Reviewing files that changed from the base of the PR and between 21c5f2b and 965aa7b.

📒 Files selected for processing: 1

• Sources/HtmlTinkerX/HtmlTinkerX.csproj

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

The project updates its Jint package reference from version 4.16.4 to 4.17.0 and its NUglify package reference from version 1.23.3 to 1.23.4.

Changes: Package updates

Layer / File(s)	Summary
Update package versions Sources/HtmlTinkerX/HtmlTinkerX.csproj	The project updates the Jint and NUglify package versions.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: przemyslawklys

Merge Risk: ⚪ Minimal · up to 965aa

This updates Jint and NUglify without changing the library’s call sites or public API. No actionable merge-blocking risk is established, though normal restore, build, and test checks remain appropriate.

### Architecture Summary

Architecture risk: 🔵 Low · up to 965aa

The change affects 1 system.

Changed systems: Sources

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — Sources (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in Sources/HtmlTinkerX/HtmlTinkerX.csproj: Upgrades the Jint package from 4.16.4 to 4.17.0 and NUglify from 1.23.3 to 1.23.4.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately identifies the main change as two dependency updates. It is concise and related to the changeset, although it does not name the updated packages.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.48%. Comparing base (21c5f2b) to head (965aa7b).

Additional details and impacted files

@@                Coverage Diff                 @@
##           v2-speedygonzales     #549   +/-   ##
==================================================
  Coverage              60.48%   60.48%           
==================================================
  Files                    505      505           
  Lines                  37101    37101           
  Branches                7553     7553           
==================================================
  Hits                   22441    22441           
  Misses                 12176    12176           
  Partials                2484     2484           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.