Merge origin/main into fix/throw-errors

Author: Copilot

.github/workflows/dependency-review.yml

@@ -19,4 +19,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/npm_release.yml

@@ -18,7 +18,7 @@ jobs:
       npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
       - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
@@ -87,7 +87,7 @@ jobs:
     needs: build
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
       - uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
@@ -162,7 +162,7 @@ jobs:
       NPM_TAG: ${{needs.build.outputs.npm_tag}}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
       - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
@@ -211,7 +211,7 @@ jobs:
       NPM_VERSION: ${{needs.build.outputs.npm_version}}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/scorecards.yml

@@ -68,6 +68,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+        uses: github/codeql-action/upload-sarif@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           sarif_file: results.sarif

NativeScript/inspector/JsV8InspectorClient.mm

@@ -22,6 +22,20 @@
 
 namespace v8_inspector {
 
+namespace {
+// Build an 8-bit `StringView` directly over a `std::string`'s storage.
+// V8 inspector messages on this side are ASCII/UTF-8 JSON, so the
+// previous `std::string -> std::vector<uint16_t> -> StringView` path
+// inflated each byte to two and then handed it to a 16-bit constructor.
+// Going straight through the 8-bit constructor avoids that doubling AND
+// dodges the libc++ deprecation that prompted the inspector's
+// `UChar = uint16_t -> char16_t` switch.
+StringView Make8BitStringView(const std::string& value) {
+  return StringView(reinterpret_cast<const uint8_t*>(value.data()),
+                    value.size());
+}
+}  // namespace
+
 #define NOTIFICATION(name)                                 \
   [[NSString stringWithFormat:@"%@:NativeScript.Debug.%s", \
                               [[NSBundle mainBundle] bundleIdentifier], name] UTF8String]
@@ -128,6 +142,18 @@
     dispatch_semaphore_signal(messageArrived_);
   });
 
+  // Debugger.pause needs to interrupt V8 even if the main thread is busy
+  // executing JS. RequestInterrupt fires at the next safe bytecode boundary.
+  auto parsed = json::parse(message, nullptr, false);
+  if (!parsed.is_discarded() && parsed.contains("method") && parsed["method"] == "Debugger.pause") {
+    isolate_->RequestInterrupt(
+        [](Isolate* isolate, void* data) {
+          auto client = static_cast<JsV8InspectorClient*>(data);
+          client->session_->schedulePauseOnNextStatement({}, {});
+        },
+        this);
+  }
+
   tns::ExecuteOnMainThread([this, message]() {
     dispatch_sync(this->messageLoopQueue_, ^{
       // prevent execution if we're already pumping messages
@@ -257,8 +283,7 @@
 }
 
 void JsV8InspectorClient::dispatchMessage(const std::string& message) {
-  std::vector<uint16_t> vector = tns::ToVector(message);
-  StringView messageView(vector.data(), vector.size());
+  StringView messageView = Make8BitStringView(message);
   Isolate* isolate = isolate_;
   v8::Locker locker(isolate);
   Isolate::Scope isolate_scope(isolate);
@@ -343,8 +368,7 @@
       auto returnString = GetReturnMessageFromDomainHandlerResult(result, requestId);
 
       if (returnString.size() > 0) {
-        std::vector<uint16_t> vector = tns::ToVector(returnString);
-        StringView messageView(vector.data(), vector.size());
+        StringView messageView = Make8BitStringView(returnString);
         auto msg = StringBuffer::create(messageView);
         this->sendNotification(std::move(msg));
       }
@@ -486,8 +510,7 @@
   Local<v8::String> arg = args[0].As<v8::String>();
   std::string message = tns::ToString(isolate, arg);
 
-  std::vector<uint16_t> vector = tns::ToVector(message);
-  StringView messageView(vector.data(), vector.size());
+  StringView messageView = Make8BitStringView(message);
   auto msg = StringBuffer::create(messageView);
   client->sendNotification(std::move(msg));
 }

NativeScript/inspector/src/inspector/string-16.h

@@ -17,7 +17,13 @@
 
 namespace v8_inspector {
 
-using UChar = uint16_t;
+// Xcode 26.x libc++ deprecates `std::basic_string<unsigned short>`
+// (and any `char_traits<T>` specialization for non-standard char types).
+// Switch to `char16_t` so `std::basic_string<UChar>` resolves to the
+// fully supported `std::u16string`. The V8 inspector public API still
+// takes `uint16_t*`, so call sites that cross that boundary now use
+// `reinterpret_cast` (see string-util.h).
+using UChar = char16_t;
 
 class String16 {
  public:

NativeScript/inspector/src/inspector/string-util.h

@@ -30,13 +30,17 @@ class StringUtil {
   }
 
   static String fromUTF16LE(const uint16_t* data, size_t length) {
-    return String16::fromUTF16LE(data, length);
+    // V8 inspector protocol passes `uint16_t*` over its public API but
+    // `String16` is now backed by `std::u16string` (UChar = char16_t).
+    // The two are bit-identical 16-bit codepoints, so a reinterpret_cast
+    // is sound at the API boundary.
+    return String16::fromUTF16LE(reinterpret_cast<const UChar*>(data), length);
   }
 
   static const uint8_t* CharactersLatin1(const String& s) { return nullptr; }
   static const uint8_t* CharactersUTF8(const String& s) { return nullptr; }
   static const uint16_t* CharactersUTF16(const String& s) {
-    return s.characters16();
+    return reinterpret_cast<const uint16_t*>(s.characters16());
   }
   static size_t CharacterCount(const String& s) { return s.length(); }
 };

NativeScript/inspector/utils.mm

@@ -35,17 +35,22 @@
 }
 
 std::string v8_inspector::ToStdString(const StringView& value) {
-    std::vector<uint16_t> buffer(value.length());
+    // Build the std::u16string directly. The previous version went via
+    // std::vector<uint16_t> + a copy-construct into u16string, which on
+    // Xcode 26.x's libc++ tripped the `char_traits<unsigned short>`
+    // deprecation through the construct-from-iterator path. Writing
+    // char16_t straight into the destination avoids the
+    // non-standard char-traits specialization entirely.
+    std::u16string value16;
+    value16.resize(value.length());
     for (size_t i = 0; i < value.length(); i++) {
         if (value.is8Bit()) {
-            buffer[i] = value.characters8()[i];
+            value16[i] = static_cast<char16_t>(value.characters8()[i]);
         } else {
-            buffer[i] = value.characters16()[i];
+            value16[i] = static_cast<char16_t>(value.characters16()[i]);
         }
     }
 
-    std::u16string value16(buffer.begin(), buffer.end());
-
 #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
     // FIXME: std::codecvt_utf8_utf16 is deprecated
     std::wstring_convert<std::codecvt_utf8_utf16<char16_t>, char16_t> convert;