chore: replace grunt with npm scripts - #265
Open
littlespex wants to merge 4 commits into
Open
Conversation
- sax 1.2.1 -> ^1.6.1: hardening against hostile input (quadratic CDATA allocation fix, attribute count/depth limits, invalid code point checks, stricter char-ref validation in strict mode). Note: sax relicensed ISC -> BlueOak-1.0.0 as of 1.4.2. - @rollup/plugin-commonjs ^29, @rollup/plugin-node-resolve ^16, globals ^17: major bumps, no config changes required. - eslint / @eslint/js floors raised to current 9.x. - Lockfile regenerated; npm audit reports 0 vulnerabilities. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The build was already tsc and rollup, with grunt shelling out to both via grunt-exec. The remaining native grunt work (assembling the test webapp in build/public_html and cleaning build output) moves to scripts/build.js, a dependency-free node script driven by the same properties.json. npm run build, build:debug, build:release, clean, and prepublishOnly keep their previous behavior; build output is byte-identical to the grunt pipeline. Removes grunt and its four plugins, 88 packages out of the lockfile. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
littlespex
marked this pull request as ready for review
August 31, 2026 19:14
Resolves conflicts with the DOMParser parameterization (665e022): - Gruntfile.cjs: kept deleted; its upstream change (stop copying sax to the webapp libs) is ported to scripts/build.js - package-lock.json: regenerated from the upstream lockfile with the grunt packages pruned Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Sep 1, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #264, and stacked on that branch. Until #264 merges, the diff here shows both changes; the grunt removal is the single commit cc938c1.
What changed
The build was already tsc plus rollup. Grunt ran both through
grunt-execand did native work in only two places: assembling the test webapp inbuild/public_html(grunt-sync,grunt-npmcopy) and deleting build output (grunt-contrib-clean).npm run build,build:debug, andbuild:releasenow calltsc,rollup, andnode scripts/build.jsdirectly.buildis still an alias ofbuild:debug, andprepublishOnlystill runs the release build. Acleanscript replaces the grunt clean task.scripts/build.jsis a small dependency-free node script. It reads the sameproperties.json, copies the webapp harness, test resources, and the sax/FileSaver/jszip browser libs, and picks the debug or minified bundle forlibs/imsc.js. The imsc-tests submodule copies skip missing sources, the same behavior the grunt-sync globs had when the submodule is not checked out.grunt,grunt-contrib-clean,grunt-exec,grunt-npmcopy, andgrunt-syncare gone from devDependencies. The lockfile drops from 257 packages to 169. Three of the removed packages were pinned tolatest.Notes for review
build/anddist/matches for both the debug and release builds.fs.cpSyncis stable as of Node 22.3, which covers the Node 22 CI image.build, as it did under grunt, so CI behavior is unchanged.Testing
From a clean tree (
node_modules,build, anddistremoved):npm ci,npm run lint,npm run build, andnpm test(7 of 7) all pass.npm run build:releaseandnpm run cleanverified as well. Output hashes compared against a grunt baseline built from the #264 branch.🤖 Generated with Claude Code