client testing - #8468
Conversation
There was a problem hiding this comment.
Pull request overview
This pull request updates the gulp-qunit-harness dependency from version ^1.0.3 to 1.1.0, changing the source from npm registry to a GitHub-hosted tarball from a personal repository.
Key Changes
- Replaces
gulp-qunit-harnessdependency source from npm registry to a GitHub tarball URL - Updates the underlying
qunit-harnesspackage to@devexpress/qunit-harnessv1.5.0 - Increases minimum Node.js version requirement from ">= 0.10" to ">= 18.0.0"
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| package.json | Updates gulp-qunit-harness dependency source to GitHub tarball URL |
| package-lock.json | Reflects dependency tree changes including new @devexpress scoped packages, version updates for transitive dependencies (axios, form-data, @types/node), and minimum Node.js version requirement change |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "gulp-mocha-simple": "^2.0.0", | ||
| "gulp-mustache": "^3.0.1", | ||
| "gulp-qunit-harness": "^1.0.3", | ||
| "gulp-qunit-harness": "https://github.com/Bayheck/Builds/raw/main/gulp-qunit-harness-1.1.0.tgz", |
There was a problem hiding this comment.
Using a direct GitHub URL to download a tarball from a personal repository raises security and maintainability concerns. This approach bypasses npm's registry verification and version management. The package source should be from a trusted npm registry or official repository. Consider publishing this version to npm registry or using a properly tagged GitHub release with semantic versioning.
| "gulp-qunit-harness": "https://github.com/Bayheck/Builds/raw/main/gulp-qunit-harness-1.1.0.tgz", | |
| "gulp-qunit-harness": "^1.1.0", |
Purpose
Describe the problem you want to address or the feature you want to implement.
Approach
Describe how your changes address the issue or implement the desired functionality in as much detail as possible.
References
Provide a link to the existing issue(s), if any.
Pre-Merge TODO