NuGet の依存を更新する Bump Jint from 4.16.4 to 4.17.0

[dependabot]

Updated Jint from 4.16.4 to 4.17.0.

Release notes

Sourced from Jint's releases.

4.17.0

Jint 4.17.0 is a release from the 4.x branch. It backports correctness and conformance fixes from main (four of them for scripts that could end the host process), linear string building, and two new opt-in APIs for hosts. That is why it is a minor release rather than a patch. Nothing in it changes an existing API or an existing default, so it is a drop-in update from 4.16.4.

Highlights

A pooled engine can let go of a finished request's objects. Hosts that reuse one engine across many evaluations (CaptureGlobalSnapshot once, RestoreGlobalSnapshot between runs) keep the interpreter's warmed caches, and that is the point of reusing it. But a warmed call site remembers the last function it called, and a warmed member read remembers the last object it read from. In a pooled web host, that can be a delegate built from a finished request's services, which then stay alive until the same script runs again. The new Engine.Advanced.DiscardInterpreterCaches() drops those caches, so the objects can be collected. The engine, its intrinsics and its global object stay as they are. The next run of each script rebuilds its cache, which costs roughly what a first run on a new engine costs, minus building the engine. A good place to call it is when an engine has been idle for a while, rather than after every use (#​4229, from #​4227).

A host can carry its own state across await. Jint now runs ECMAScript's HostMakeJobCallback and HostCallJobCallback steps for every promise reaction, every thenable job and the FinalizationRegistry cleanup callback. A host can take part through the new Options.Host.JobCallbacks, which accepts a JobCallbackHooks with Capture, Enter and Exit callbacks. That lets each branch of a Promise.all fan-out keep its own host context, such as a logging scope or ambient request data, through every await (#​4231, from #​4230; issue #​4200). The default is no hooks, in which case each promise registration costs one null check and nothing a script can observe changes.

Four more ways for a script to end the host process are closed.

• ShadowRealm. A failure crossing a ShadowRealm boundary threw its TypeError copy from inside the catch that was handling the original failure. That added a nested exception dispatch at every hop, and no stack check could see it. Even with the stack-overflow guard on, a long chain of wrapped functions ended the process on the way back out, and a three-line script with a name getter needed no chain at all. Building that copy also ran script (toString, getters, proxy traps); it no longer does. A failed importValue now reports the import failure instead of an unrelated error (#​4220, from #​4176 and #​4183).
• instanceof and eval. instanceof now checks the native stack before calling a custom Symbol.hasInstance method, and eval checks it before parsing. A self-referencing Symbol.hasInstance, or var s = 'eval(s)'; eval(s), now raises a RangeError the script can catch instead of ending the process. On the MaxExecutionStackCount path, eval also stopped hopping to a new thread at each overflow without ever throwing. instanceof over a bound function now consults every bound link's own Symbol.hasInstance, as the specification requires (#​4221, from #​4172, #​4184 and #​4187).
• These checks follow 4.x's existing rule. Like every other stack check on 4.x, they are active only when Options.Constraints.StackOverflowGuard is on, so turn it on for any script you do not fully trust.

Building a string with s = s + x is linear. A + whose result reaches 512 characters now produces a deferred string instead of copying both sides. Building with s = s + x, s = x + s and s = s + a + b therefore becomes linear, as s += x already was. Short concatenations take a separate path and pay nothing for this. The deferred string is safe to read from several engines that share one Prepared<Script>, and it is charged to LimitMemory when it is built, so a memory limit still bounds it. Binding an already-bound function also no longer copies its whole "bound …" name at every level (#​4160, from #​3386, #​3571, #​4130, #​4164 and #​4173).

Array.prototype.concat spreads host arrays and lists. Since 4.14, CLR arrays and lists reach script as live views by default. concat added such a view as a single element instead of spreading its items, so a.concat(b) returned the two wrappers. It now spreads anything script sees as an array (#​4219, from #​4216; issue #​4201).

TypedArray.prototype.with survives a shrinking coercion. When converting the index or the value made a resizable buffer shorter, with copied past its new end and let a CLR ArgumentException escape. It now copies only what the buffer still holds (#​4218, from #​4157).

Verification

Every backport was verified failing-first: its tests were run against the unfixed 4.x tree on .NET 10 and .NET Framework 4.7.2, then with the change. The release candidate was measured against 4.16.4 on SunSpider and Dromaeo in six paired rounds, alternating which build ran first in each round. The four Dromaeo ObjectRegExp rows ran 12–15% faster and SunSpider's 3d-raytrace 2.3% faster. No row regressed by 1% or more; the two rows whose interval did not include zero (one Dromaeo Cube variant, +0.70%, and SunSpider's controlflow-recursive, +0.88%) are within this machine's run-to-run noise.

What's Changed

• Backport culture-independent overload-scoring fixture to 4.x by @​PrzemyslawKlys in Backport culture-independent overload-scoring fixture to 4.x sebastienros/jint#4215
• Backport #​4216 to 4.x: make Array.prototype.concat spread host arrays and lists by @​lahma in Backport #4216 to 4.x: make Array.prototype.concat spread host arrays and lists sebastienros/jint#4219
• Backport #​4176, #​4183 to 4.x: keep a ShadowRealm failure copy from killing the host or running script by @​lahma in Backport #4176, #4183 to 4.x: keep a ShadowRealm failure copy from killing the host or running script sebastienros/jint#4220
• Backport #​3386, #​3571, #​4130, #​4164 and #​4173 to 4.x: linear string building, safe across engines and charged to LimitMemory by @​lahma in Backport #3386, #3571, #4130, #4164 and #4173 to 4.x: linear string building, safe across engines and charged to LimitMemory sebastienros/jint#4160
• Backport #​4172, #​4184, #​4187 to 4.x: stop instanceof and eval recursions from killing the host by @​lahma in Backport #4172, #4184, #4187 to 4.x: stop instanceof and eval recursions from killing the host sebastienros/jint#4221
• Backport #​4157 to 4.x: Fix TypedArray.prototype.with after a shrinking coercion by @​lahma in Backport #4157 to 4.x: Fix TypedArray.prototype.with after a shrinking coercion sebastienros/jint#4218
• Backport #​4227 to 4.x: Let a reused engine discard the host objects its warmed caches hold by @​lahma in Backport #4227 to 4.x: Let a reused engine discard the host objects its warmed caches hold sebastienros/jint#4229
• Backport #​4230 to 4.x: Let a host carry its own state across await through HostMakeJobCallback by @​lahma in Backport #4230 to 4.x: Let a host carry its own state across await through HostMakeJobCallback sebastienros/jint#4231

Full Changelog: sebastienros/jint@v4.16.4...v4.17.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

⚠️ PR 本文に Closes #N が見つかりません。

規約では PR と Issue を必ず紐付けることになっています（.github/copilot-instructions.md の「必ず守る規約」3）。

マージ時に Issue が自動で閉じられ、何が終わって何が残っているかを追えます。

紐付く Issue が無い PR であれば、このコメントは無視して構いません。

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 12fbe3e.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
nuget/Jint	4.17.0	🟢 5.4	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Code-Review ⚠️ 0 Found 2/25 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ -1 no releases found Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Packaging 🟢 10 packaging workflow detected

Scanned Files

• src/VehicleVision.PleasanterTools.Questionnaire.Scripting/VehicleVision.PleasanterTools.Questionnaire.Scripting.csproj

[dependabot]

Looks like Jint is no longer updatable, so this is no longer needed.