chore(deps): update all non-major dependencies (minor)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
Jint	4.15.3 → 4.16.0
Microsoft.NET.Test.Sdk	18.8.1 → 18.9.0

---

Release Notes

sebastienros/jint (Jint)

v4.16.0

Jint 4.16.0 is a correctness- and reliability-focused release: alongside asynchronous module loading, proper tail calls and four new iterator built-ins, a pre-tag review swept the whole engine and fixed what it found — including long-standing defects that predate this cycle. No option defaults changed. Behaviour changes to note up front: JSON.stringify and other machine-readable output now format invariantly under every host culture — under Swedish or Finnish locales on .NET 8+ it used to emit a Unicode minus sign no JSON parser accepts; JSON.parse now rejects trailing commas as the grammar requires; bare identifiers at global scope resolve through the global's prototype chain per spec; IModuleLoader.Resolve is consulted once per (referrer, specifier) pair, so a loader using it as a per-import access-control checkpoint should move the check to LoadModule; and an inconsistent sort comparator now finishes with an implementation-defined order on every target framework instead of hanging (net462/netstandard) or throwing a CLR exception at script (net8+).

Highlights

Proper tail calls (#​2975). Strict-mode calls in tail position reuse their frame, so "use strict" tail recursion runs in constant stack — the first ES2015 PTC implementation among the .NET engines.

Asynchronous module loading (#​2872). IAsyncModuleLoader and the AsyncModuleLoader template let a host fetch module source over I/O without blocking a thread; Engine.Modules.StartImport returns an operation a game loop drives via ProcessTasks(), and ImportAsync awaits without holding a thread. The spec's load phase now exists as written, a warm-cache async loader keeps the blocking Import fully synchronous, and the blocking drain wakes on a work-arrived signal instead of polling. A module served over a transport keeps its whole url as Module.Location so its own relative imports resolve, a deferred namespace evaluates its module instead of exposing uninitialized bindings, and an import abandoned by a global snapshot restore reports itself faulted instead of polling forever.

The process no longer dies for recoverable reasons. Options.LimitRecursion used to kill the host process for most useful limits — the constraint fired, and the unwind itself overflowed the stack; exception filters now let it unwind ~7× deeper. The new opt-in Options.Constraints.StackOverflowGuard converts unbounded recursion — reachable through eighteen distinct routes, new, accessors, coercions and Proxy traps included — from a process kill into a catchable RangeError, exempting strict tail calls, which grow no stack. And a family of CLR exceptions that escaped engine.Evaluate past every script catch are now proper JavaScript errors or correct results: sorting with an inconsistent comparator, destructuring with a function-valued default (const { onChange = () => {} } = opts), toLocaleString outside DateTime's range, typed-array defineProperty without a value, DataView reads at 2³¹, String.replace $' with a lying exec, and the first instant of year 10000.

New built-ins. Iterator.prototype.join, chunks, windows and includes; take/drop now throw RangeError for a finite limit above 2^53−1 per the updated proposals. Intl.Locale.prototype.getCollations reports CLDR-cited collation data that Intl.Collator accepts in full, a malformed collation option is a RangeError, and Intl.supportedValuesOf("collation") derives from the same lists so the three can never drift.

Conformance, from a review that ran what the suite does not. Two of the fixed defects had test262 coverage only under the never-generated staging/ directory, and several had none at all: parseInt strips the sign before testing for a hex prefix, so parseInt("-0x10") is −16; a suspended finally no longer swallows a pending break/continue; a Proxy (or exotic host object) as the global's prototype answers bare identifiers through its get trap; Date.prototype.toISOString emits the spec's six-digit expanded year and round-trips through Date.parse in every spelling including year 0; iterator helpers close their receiver exactly once and only when the spec says so, and carry their own @@toStringTag; Map/Set size is the prototype accessor the spec defines rather than a phantom own property; a Proxy's defineProperty trap receives the partial descriptor the caller wrote; a string's @@iterator is read once, with the primitive as receiver; Array.prototype.join re-asks the array when a side effect fills a hole mid-join; a direct eval reaches the enclosing function's arguments in both modes; and Temporal.Now drops the methods the proposal removed.

Embedder surface. OperationDeadlineConstraint bounds a whole multi-entry host operation; ScriptPreparationOptions.StaticAnalysis trades prepare-time analysis for per-engine materialization on shared graphs; ModuleFactory.LocationOf exposes the module-naming rule a host must match; Engine.Advanced.HostDefined carries per-request state on a pooled engine; the CLR exception behind an interop error is reachable through JintException.TryGetClrException with opt-in ChainClrExceptions(), and a host method's own TargetException is no longer mistaken for a receiver mismatch; and a recursion-limit failure propagates out of a module load instead of becoming a catchable rejection.

Performance, gated. Against v4.15.3 on idle hardware, medians of three paired runs: controlflow-recursive −15.6% time and −40.4% allocation (proper tail calls), bitops-3bit-bits-in-byte −8.9%, math-spectral-norm −7.3%, crypto-sha1 −6.9%, 3d-raytrace −5.9%, math-cordic −5.8%, with a broad −1–4% tail across the call- and string-heavy rows; no row moved outside its own measured cross-run envelope in the other direction, and allocation is flat within ±0.2% suite-wide. Warmed parseInt call sites take the frameless fast-call lane (−13% on the parse loop), joined by the Number predicates, String.prototype.indexOf/startsWith/endsWith/includes/at/substr, global isNaN/isFinite and Array.isArray (−3% to −19%) and the Map/Set method family (map.get hit loop −13%); existence questions on a wrapped dictionary answer from ContainsKey, taking in −33% with −98% allocation and Object.keys −37%; resolving an inherited global no longer allocates per miss (−99.99% on the read loop) and a global created through an inherited write keeps the in-place store; JSON replacer/reviver eligibility is decided once per document, built-in callback dispatch once per loop, a call site's arguments reach an interpreted callee in registers, and function-local let/const live in fixed slots.

Breaking changes. Int32Extensions/Int64Extensions/DoubleExtensions — polyfill hosts that leaked into the public API — are now internal; on net462/netstandard2.0, code with using Jint; may have bound span Parse/TryParse members through them. JsonParser rejects trailing commas. Number.parseInt.length/Number.parseFloat.length report their spec values. Post-construction mutation of an Options instance no longer reaches an already-built engine, and Options.Configure callbacks work again. UnwrapIfPromise reports a cancelled engine as ExecutionCanceledException instead of a timeout. Time-zone matching is ASCII-case-insensitive per ECMA-402.

On the engine comparison benchmarks, Jint 4.16.0 is the fastest engine outright on 5 of 12 scripts — leading dromaeo-object-regexp-modern over native V8 by 1.25× — in a statistical tie for first on interop-collection-traversal, the fastest managed engine on 10 of 12, the fastest interpreter on all 12, and 8.6×–11.2× ahead of ClearScript (native V8) on every interop row while allocating 3.9×–12.4× less than the nearest managed competitor.

What's Changed

• Run the repository's own host tests under Release-mode contract verification by @​lahma in #​2866
• Update test262 suite and implement Iterator.prototype.join by @​lahma in #​2867
• Stop a closing iterator from swallowing the error that closed it by @​lahma in #​2868
• Give every benchmark row its own engine by @​lahma in #​2873
• Hand a call site's arguments to an interpreted callee in registers by @​lahma in #​2874
• Ask once per loop, not once per element, how to call a built-in's callback by @​lahma in #​2876
• Say which spec document to read for a feature by @​lahma in #​2882
• Run PR CI on every pull request, not only those targeting main by @​lahma in #​2883
• Update test262 suite and adopt the new take/drop RangeError by @​lahma in #​2877
• Implement Iterator Chunking by @​lahma in #​2878
• Say to write against the modern BCL and polyfill downwards by @​lahma in #​2884
• Implement Iterator Includes by @​lahma in #​2879
• Ask once per document, not once per key, how to call a JSON replacer or reviver by @​lahma in #​2885
• Use double.IsFinite instead of hand-rolled NaN and infinity pairs by @​lahma in #​2880
• Bump the testing group with 1 update by @​dependabot[bot] in #​2889
• Stop charging closures for per-engine lazy globals by @​lahma in #​2890
• Bump the analyzers group with 1 update by @​dependabot[bot] in #​2888
• Make the lazy-global re-arm on restore a contract instead of an accident by @​lahma in #​2892
• Let the amortized constraint cadence span top-level entries into the engine by @​lahma in #​2886
• Let a function's own let/const live in its fixed slots by @​lahma in #​2887
• Keep a host function in the engine's own realm after a second realm exists by @​lahma in #​2893
• Make an engine's principal realm [[HostDefined]] reachable by @​lahma in #​2891
• Carry a labelled break/continue target on the completion record by @​lahma in #​2894
• Make Array.prototype.sort stable on every target framework by @​lahma in #​2898
• Stop toSorted and %TypedArray%.sort hanging on an inconsistent comparator by @​lahma in #​2899
• Delete the evaluation context's dead completion channel by @​lahma in #​2895
• Stop shipping the numeric polyfill hosts as public API by @​lahma in #​2901
• Give the evaluation context to the engine, and "is evaluating" its own signal by @​lahma in #​2896
• Retire the hand-rolled SkipLocalsInit and the stale PolySharp workaround by @​lahma in #​2902
• Give the target-framework guards one vocabulary by @​lahma in #​2903
• Back GetArrayDataReference so the unchecked write helpers drop their #if by @​lahma in #​2904
• Parse from spans on every target framework by @​lahma in #​2905
• Back the vectorized MemoryExtensions searches used by String, RegExp and URI code by @​lahma in #​2907
• Use the span-taking text APIs on every target framework by @​lahma in #​2908
• Backfill Dictionary.TryAdd, and stop lowercasing to look up a time zone by @​lahma in #​2909
• Backfill the remaining one-member API gaps by @​lahma in #​2910
• Build strings from spans, and retire SUPPORTS_SPAN_PARSE by @​lahma in #​2911
• Stop allocating a string[] to read one language subtag by @​lahma in #​2912
• Correct what the hand-rolled hashes say about HashCode.Combine by @​lahma in #​2913
• Say char.IsAsciiDigit where the locale parsers spelled out the range by @​lahma in #​2915
• Keep a static block's declarations out of the enclosing scope, and a class name in it by @​gkurt in #​2914
• Hold an error's CLR origin behind one reference by @​lahma in #​2916
• Cover Uint8Array base64 on a target framework that actually runs it by @​lahma in #​2920
• Keep the CLR exception behind a caught interop error by @​lahma in #​2917
• Only bind a module's own lexical declarations at module level by @​gkurt in #​2869
• Stop the host-loop timeout tests asserting that the machine never stalls by @​lahma in #​2922
• Derive the hoisting walk's module flag from the node it walks by @​lahma in #​2923
• Let a host ask for the CLR exception in the inner-exception chain by @​lahma in #​2918
• Let a module keep the whole url it was loaded from by @​gkurt in #​2871
• Document error handling in the README by @​lahma in #​2919
• Upgrade to Acornima v1.7.0 by @​adams85 in #​2924
• Resume an awaiting for-let loop into the environment it suspended in by @​HermanusMuellerEU in #​2875
• Find a registered module under the name it was registered with by @​gkurt in #​2870
• Invoke a CLR method inherited through the prototype chain on its owning instance by @​lahma in #​2928
• Bump the js-engine-comparisons group with 1 update by @​dependabot[bot] in #​2931
• Stop caching hoisting scopes for modules and block state for function bodies by @​lahma in #​2929
• Upgrade Meziantou.Analyzer to 3.0.141 by @​lahma in #​2933
• Upgrade the test262 harness tool to 1.1.1 by @​lahma in #​2934
• Fix typo in XML-doc comments by @​latent-9 in #​2932
• Let a host load modules asynchronously, as ECMA-262 already specifies by @​gkurt in #​2872
• Measure what an ES module graph costs a pooled-engine embedder by @​lahma in #​2926
• Give a multi-entry host operation one deadline the per-entry reset cannot rewind by @​lahma in #​2935
• Expose the module-location rule a host has to match by @​lahma in #​2936
• Record what a delta from the module-graph benchmark is worth by @​lahma in #​2937
• Let a host prepare a script or module without the static analysis by @​lahma in #​2938
• Document sharing a module graph across pooled engines by @​lahma in #​2940
• Treat a non-positive operation budget as no deadline rather than an expired one by @​lahma in #​2939
• Keep the chained CLR stack out of the JavaScript error string by @​lahma in #​2949
• Index the surface v4.16 added in the contract table by @​lahma in #​2943
• Document the two v4.16 surfaces the README has no line for by @​lahma in #​2942
• Stop sort throwing a CLR ArgumentException at script on net8 and net10 by @​lahma in #​2954
• Label the MyGet previews with the version they are previews of by @​lahma in #​2941
• Strip the sign before testing parseInt's argument for a hex prefix by @​lahma in #​2945
• Park a break or continue across the finally that suspends by @​lahma in #​2944
• Tell a wrong receiver apart from a host method that threw TargetException itself by @​lahma in #​2947
• Ask an exotic global prototype for a bare identifier through [[Get]] by @​lahma in #​2946
• Stamp Atomics.waitAsync's settle with the cycle that registered it by @​lahma in #​2957
• Keep the memory-limit constraint's reset total so it cannot replace a script error by @​lahma in #​2956
• Make the Math.Clamp polyfill reject inverted bounds like the BCL does by @​lahma in #​2955
• Take the operator-overloading reading after the options are applied by @​lahma in #​2948
• Decide at build time which call sites can arm the register lane by @​lahma in #​2951
• Say that prototype pollution now survives a restore as a binding by @​lahma in #​2950
• Let a host see that a restore abandoned its module import by @​lahma in #​2959
• Return JSON.parse's pooled reviver arguments when the reviver throws by @​lahma in #​2952
• Stop CreateLazy wrapping the factory the descriptor already guards by @​lahma in #​2953
• Evaluate a module Import finds in any state ModuleEvaluation accepts by @​lahma in #​2958
• Let a recursion-limit failure out of a module load instead of rejecting by @​lahma in #​2960
• Say that a host may be asked to resolve one specifier more than once by @​lahma in #​2961
• Format machine-readable output invariantly, not in the host's culture by @​lahma in #​2963
• Stop the first instant of year 10000 throwing a CLR exception out of Date by @​lahma in #​2965
• Wake the blocking promise wait on the work-arrived signal instead of polling by @​lahma in #​2966
• Emit a six-digit expanded year from Date.prototype.toISOString by @​lahma in #​2964
• Remove the rest-parameter state an arguments object can never carry by @​lahma in #​2967
• Let parseInt and parseFloat take the frameless fast-call lane by @​lahma in #​2968
• Call an iterator's return exactly once when a helper exits early by @​lahma in #​2970
• Accept the collations Intl.Locale.prototype.getCollations reports by @​lahma in #​2974
• Answer a wrapped dictionary's existence questions from ContainsKey by @​lahma in #​2969
• Stop closing an iterator whose step completed abruptly by @​lahma in #​2971
• Print a rejected iterator limit the way JavaScript prints numbers by @​lahma in #​2972
• Stop pure extension methods from shadowing Array.prototype natives by @​lahma in #​2977
• Tag iterator helper objects as Iterator Helper by @​lahma in #​2973
• Update test262 to 3655e74 and make Promise.try use PromiseResolve by @​lahma in #​2978
• Name a destructuring default only when the default was evaluated by @​lahma in #​2993
• Name the class in the constructor-without-new TypeError by @​lahma in #​2990
• Count parsed times in ticks so the last millisecond of 9999 survives by @​lahma in #​2983
• Reject a malformed collation option with a RangeError by @​lahma in #​2988
• Give the iterator helpers return's real state machine by @​lahma in #​2992
• Mark a global created through an inherited write as a mutable binding by @​lahma in #​2986
• Let a direct eval reach the enclosing function's arguments object by @​lahma in #​2979
• Keep both CLR facts when an error carries resolution info and an exception by @​lahma in #​2991
• Clamp the substitution tail the way GetSubstitution specifies by @​lahma in #​2998
• Reject a trailing comma everywhere JSON is parsed by @​lahma in #​2997
• Serve Map and Set size from the prototype accessor the spec defines by @​lahma in #​2995
• Define a typed array element without a value without crashing by @​lahma in #​2999
• Keep a DataView index whole until the spec has bounds-checked it by @​lahma in #​3000
• Read a string's iterator once, with the primitive as receiver by @​lahma in #​3002
• Hand the defineProperty trap the descriptor the caller wrote by @​lahma in #​3001
• Drop the Temporal.Now methods the proposal removed by @​lahma in #​2996
• Render a locale string for every date the spec calls valid by @​lahma in #​2981
• Parse the year the formatter is required to emit by @​lahma in #​2982
• Pin generic type arguments from the receiver, and snapshot lazy sequences on request by @​lahma in #​3004
• Implement proper tail calls for strict functions by @​sebastienros in #​2975
• Stop allocating a JsString for every inherited-global resolution by @​lahma in #​2985
• Let Map and Set lookups run frameless by @​lahma in #​2984
• Let a constraint exception unwind deep recursion without overflowing by @​lahma in #​2994
• Report the collations CLDR actually defines by @​lahma in #​2989
• Ask the array again when join meets a hole by @​lahma in #​3003
• Offer a stack-overflow guard that turns a process kill into a RangeError by @​lahma in #​3005
• Derive the supported collations from the per-locale lists by @​lahma in #​3006
• Let the cheapest builtin calls run frameless by @​lahma in #​2980
• Refresh engine comparison benchmarks for 4.16.0 by @​lahma in #​3007

New Contributors

• @​latent-9 made their first contribution in #​2932

Full Changelog: sebastienros/jint@v4.15.3...v4.16.0

microsoft/vstest (Microsoft.NET.Test.Sdk)

v18.9.0

What's Changed

• Fix tilde/exclamation characters corrupted in TerminalLogger test output by @​nohwnd in #​16046
• Make TranslationLayer Native AOT-compatible by @​drewnoakes in #​16045
• Guard GenerateProgramFile target against UseWinUI/UseUwpTools evaluation order by @​nohwnd in #​16072
• Add RequestingAssembly to AssemblyResolveEventArgs for binary compat by @​nohwnd in #​16076
• Remove stale Microsoft.Extensions.FileSystemGlobbing binding redirect from testhost.x86 and datacollector by @​Evangelink in #​16082
• Fix TRX attachment paths when LogFileName contains a subdirectory by @​nohwnd in #​15791
• Fix missing dumps for .NET Framework child processes in NetClientHangDumper by @​nohwnd in #​16098
• Fix data collection channels to use negotiated protocol version instead of V1 by @​nohwnd in #​16096
• Fix race condition in BlameCollector: skip hang dump when testhost hasn't launched yet by @​nohwnd in #​16065
• Replace TestSDKAutoGeneratedCode with ExcludeFromCodeCoverage in auto-generated Program files by @​nohwnd in #​16101
• Include testhost process path in crash error messages by @​nohwnd in #​16108
• Fix DataDriven test results being double-counted in TRX logger totals by @​nohwnd in #​15766
• Fix datacollector crash visibility: replace Assert with throwable exceptions by @​nohwnd in #​16048
• Add TreatErrorMessagesAsWarnings parameter to TRX logger by @​nohwnd in #​16106
• Wait for testhost stderr to drain before reading its crash output by @​nohwnd in #​16128
• Handle runtimeconfig.dev.json without additionalProbingPaths by @​tmat in #​16166
• Suggest Microsoft.NET.Test.Sdk when a managed test project brings no testhost by @​nohwnd in #​16169
• Fix x86 testhost loading mismatched x64 hostfxr (0x800700C1) when run via vstest.console.exe directly (#​16151) by @​azat-msft in #​16156
• Preserve the real exception (type + stack trace) when a test run aborts in BaseRunTests by @​nohwnd in #​16167

New Contributors

• @​drewnoakes made their first contribution in #​16045

Full Changelog: microsoft/vstest@v18.8.0...v18.9.0

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.