diff --git a/crates/expr/src/prelude.js b/crates/expr/src/prelude.js
index cc0405251..9307973d8 100644
--- a/crates/expr/src/prelude.js
+++ b/crates/expr/src/prelude.js
@@ -234,7 +234,7 @@ function __cubicBezier(curve) {
     x1 = curve[0]; y1 = curve[1]; x2 = curve[2]; y2 = curve[3];
   }
   if (typeof x1 !== 'number' || typeof y1 !== 'number' || typeof x2 !== 'number' || typeof y2 !== 'number' ||
-      !isFinite(x1) || !isFinite(y1) || !isFinite(x2) || !isFinite(y2)) {
+      !Number.isFinite(x1) || !Number.isFinite(y1) || !Number.isFinite(x2) || !Number.isFinite(y2)) {
     return __lin;
   }
   x1 = Math.max(0, Math.min(1, x1));
@@ -418,8 +418,8 @@ function hslToRgb(c) {
 function hexToRgb(hex) {
   var s = String(hex).replace(/^#|^0x/i, '');
   if (s.length === 3) s = s[0] + s[0] + s[1] + s[1] + s[2] + s[2];
-  var n = parseInt(s.slice(0, 6), 16);
-  var a = s.length >= 8 ? parseInt(s.slice(6, 8), 16) / 255 : 1;
+  var n = Number.parseInt(s.slice(0, 6), 16);
+  var a = s.length >= 8 ? Number.parseInt(s.slice(6, 8), 16) / 255 : 1;
   return [((n >> 16) & 255) / 255, ((n >> 8) & 255) / 255, (n & 255) / 255, a];
 }
 
@@ -502,7 +502,7 @@ function __child(c, l, group, key) {
 // it (default 1), the layer at the top (#1619).
 function __ancestor(c, l, path, countUp) {
   var n = countUp === undefined ? 1 : __v(countUp);
-  if (typeof n !== 'number' || !(n >= 1) || !isFinite(n)) __err('propertyGroup(' + countUp + '): the count must be a number of 1 or more');
+  if (typeof n !== 'number' || !(n >= 1) || !Number.isFinite(n)) __err('propertyGroup(' + countUp + '): the count must be a number of 1 or more');
   n = Math.floor(n);
   var info = __h(__ANCESTOR, c, l, path, n);
   if (info === 'layer') return __layer(c, l);
diff --git a/crates/script/src/prelude.js b/crates/script/src/prelude.js
index b9108b2a1..0c39c4dfe 100644
--- a/crates/script/src/prelude.js
+++ b/crates/script/src/prelude.js
@@ -26,7 +26,7 @@ function __err(msg) {
 }
 function __num(v, what) {
   var n = Number(v);
-  if (typeof v === "boolean" || isNaN(n)) throw __err((what || "value") + " must be a number");
+  if (typeof v === "boolean" || Number.isNaN(n)) throw __err((what || "value") + " must be a number");
   return n;
 }
 function __str(v) {
@@ -43,11 +43,11 @@ if (typeof String.prototype.substr !== "function") {
       if (this === null || this === undefined) throw new TypeError("String.substr called on null or undefined");
       var text = String(this), n = text.length;
       var from = Number(start);
-      if (isNaN(from)) from = 0;
+      if (Number.isNaN(from)) from = 0;
       // ToIntegerOrInfinity, then clamp positive or negative offsets.
       from = from < 0 ? Math.max(n + Math.ceil(from), 0) : Math.min(Math.floor(from), n);
       var count = length === undefined ? n - from : Number(length);
-      if (isNaN(count) || count <= 0) return "";
+      if (Number.isNaN(count) || count <= 0) return "";
       return text.slice(from, from + count);
     },
     writable: true, configurable: true
@@ -436,7 +436,7 @@ function __callable(o) {
 // 1-based collections with `[n]` access.
 var __coll = {
   get: function (t, k, r) {
-    if (typeof k === "string" && /^[0-9]+$/.test(k)) return t.__at(parseInt(k, 10));
+    if (typeof k === "string" && /^[0-9]+$/.test(k)) return t.__at(Number.parseInt(k, 10));
     return Reflect.get(t, k, r);
   },
 };
diff --git a/crates/script/src/scriptui.js b/crates/script/src/scriptui.js
index ddfbc1f3e..9c5000962 100644
--- a/crates/script/src/scriptui.js
+++ b/crates/script/src/scriptui.js
@@ -750,7 +750,7 @@ function __uiMouseWanted(c, inherited) {
 function __uiMouseEvent(type, target, v) {
   var num = function (x, d) {
     x = Number(x);
-    return isFinite(x) ? x : d;
+    return Number.isFinite(x) ? x : d;
   };
   var keys = { alt: !!v.altKey, control: !!v.ctrlKey, ctrl: !!v.ctrlKey, meta: !!v.metaKey, shift: !!v.shiftKey };
   return {
diff --git a/examples/plugin-catalog/scripts/validate.sh b/examples/plugin-catalog/scripts/validate.sh
index 40e37de7f..688ffdc26 100644
--- a/examples/plugin-catalog/scripts/validate.sh
+++ b/examples/plugin-catalog/scripts/validate.sh
@@ -26,12 +26,12 @@ file_url() {
 }
 
 echo "== 1. schema"
-[ "$(wc -c <"$catalog")" -le $((4 << 20)) ] || fail "the catalog is larger than 4 MB (the app's limit)"
+[[ "$(wc -c <"$catalog")" -le $((4 << 20)) ]] || fail "the catalog is larger than 4 MB (the app's limit)"
 # Exactly one object of format 1 with a packages array (an empty file or a second value fails too),
 # checked even when the schema step is skipped.
 jq -e -s 'length == 1 and (.[0] | type == "object" and .schema == 1 and (.packages | type == "array"))' "$catalog" >/dev/null \
   || fail "$catalog isn't one JSON object with \"schema\": 1 and a \"packages\" array"
-if [ "${SKIP_SCHEMA:-}" = 1 ]; then
+if [[ "${SKIP_SCHEMA:-}" = 1 ]]; then
   echo "skipped (SKIP_SCHEMA=1)"
 else
   npx --yes ajv-cli@5.0.0 validate --spec=draft2020 --strict=false -s "$here/schema.json" -d "$catalog"
@@ -39,7 +39,7 @@ fi
 
 echo "== 2. unique ids"
 dups=$(jq -r '.packages[].id' "$catalog" | sort | uniq -d)
-[ -z "$dups" ] || fail "duplicate package ids: $dups"
+[[ -z "$dups" ]] || fail "duplicate package ids: $dups"
 echo "ok"
 
 echo "== 3. downloads"
@@ -51,15 +51,15 @@ while IFS=$'\t' read -r p r id version url sha size; do
   curl -fsSL --retry 2 --max-filesize $((64 << 20)) -o "$file" "$url" || fail "$id $version: download failed"
   got_size=$(wc -c <"$file" | tr -d ' ')
   got_sha=$(sha256sum "$file" | cut -d' ' -f1)
-  [ -z "$size" ] || [ "$size" = "$got_size" ] || fail "$id $version: size is $got_size, the catalog says $size"
-  [ "$got_sha" = "$(tr 'A-F' 'a-f' <<<"$sha")" ] || fail "$id $version: SHA-256 is $got_sha, the catalog says $sha"
+  [[ -z "$size" ]] || [[ "$size" = "$got_size" ]] || fail "$id $version: size is $got_size, the catalog says $size"
+  [[ "$got_sha" = "$(tr 'A-F' 'a-f' <<<"$sha")" ]] || fail "$id $version: SHA-256 is $got_sha, the catalog says $sha"
   local_catalog=$(jq --argjson p "$p" --argjson r "$r" --arg u "$(file_url "$file")" '.packages[$p].versions[$r].url = $u' <<<"$local_catalog")
 done < <(jq -r '.packages | to_entries[] | .key as $p | .value as $pkg | $pkg.versions | to_entries[]
   | [$p, .key, $pkg.id, .value.version, .value.url, .value.sha256, (.value.size // "")] | @tsv' "$catalog")
 echo "ok"
 
 echo "== 4. load with EffectCraft"
-if [ -z "${EFFECTCRAFT_CLI:-}" ]; then
+if [[ -z "${EFFECTCRAFT_CLI:-}" ]]; then
   echo "skipped (set EFFECTCRAFT_CLI to an effectcraft-cli build)"
   exit 0
 fi
diff --git a/packaging/windows/test-legacy-fixture.ps1 b/packaging/windows/test-legacy-fixture.ps1
index 44336dca9..764ec41c3 100644
--- a/packaging/windows/test-legacy-fixture.ps1
+++ b/packaging/windows/test-legacy-fixture.ps1
@@ -8,7 +8,7 @@ $end = $source.IndexOf('$Msi = @{}', $start)
 if ($start -lt 0 -or $end -le $start) { throw 'Could not locate the legacy source transformation.' }
 # Run the test harness's exact source-producing block, with only scratch outputs.
 $block = $source.Substring($start, $end - $start).Replace('$PSScriptRoot', ("'" + $PSScriptRoot.Replace("'", "''") + "'"))
-Invoke-Expression $block
+. ([scriptblock]::Create($block))
 [xml]$legacy = Get-Content -Raw $LegacyWxs
 $ns = New-Object Xml.XmlNamespaceManager($legacy.NameTable)
 $ns.AddNamespace('w', 'http://wixtoolset.org/schemas/v4/wxs')
diff --git a/sonar-project.properties b/sonar-project.properties
index 7d13a08c4..eee8ac4bb 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -9,8 +9,15 @@ sonar.exclusions=crates/aep/tests/fixtures/tools/**
 # S1523 / S2137 (eval, Function): the expression runtime in crates/expr/src/prelude.js replaces
 # `eval` and `Function` on purpose, with wrappers that check the code they are given before it
 # runs (After Effects expressions may call them). The rules flag exactly that wrapping.
-sonar.issue.ignore.multicriteria=prelude_eval,prelude_redefine
+#
+# S7773 / S8786 (Number.isFinite and friends, String.trim): the .jsx scripts are After Effects
+# ExtendScript, which is ES3. They also run in After Effects, which has neither.
+sonar.issue.ignore.multicriteria=prelude_eval,prelude_redefine,jsx_es3_globals,jsx_es3_trim
 sonar.issue.ignore.multicriteria.prelude_eval.ruleKey=javascript:S1523
 sonar.issue.ignore.multicriteria.prelude_eval.resourceKey=crates/expr/src/prelude.js
 sonar.issue.ignore.multicriteria.prelude_redefine.ruleKey=javascript:S2137
 sonar.issue.ignore.multicriteria.prelude_redefine.resourceKey=crates/expr/src/prelude.js
+sonar.issue.ignore.multicriteria.jsx_es3_globals.ruleKey=javascript:S7773
+sonar.issue.ignore.multicriteria.jsx_es3_globals.resourceKey=**/*.jsx
+sonar.issue.ignore.multicriteria.jsx_es3_trim.ruleKey=javascript:S8786
+sonar.issue.ignore.multicriteria.jsx_es3_trim.resourceKey=**/*.jsx