Remove extract-zip from TypeScript test dependencies

[kpumuk]

The TypeScript browser test tooling still pulled extract-zip through grunt-contrib-qunit 3.1.0 and Puppeteer 1.x.

This updates grunt-contrib-qunit to 10.2.0, selects Puppeteer 25.8.0 for its browser runner, and removes extract-zip from the development dependency tree. It also aligns the downloaded QUnit assets to 2.26.0, whose event API is expected by the current Grunt plugin.

Puppeteer 25 requires Node.js 22.12 or newer for this development-only test path.

• Did you create an Apache Jira ticket? (Request account here, not required for trivial changes)
• If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"?
• Did you squash your changes to a single commit? (not required, but preferred)
• Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
• If your change does not involve any code, include [skip ci] anywhere in the commit message to free up build resources.

[Copilot]

Pull request overview

Updates the TypeScript browser test toolchain in lib/ts to remove the extract-zip dependency by upgrading the Grunt QUnit runner stack and aligning the downloaded QUnit assets with the plugin’s expected event API.

Changes:

• Bump grunt-contrib-qunit to ^10.2.0 and pin its Puppeteer runner to 25.8.0 via overrides.
• Update QUnit assets downloaded for TS tests to 2.26.0 and switch those downloads to HTTPS.
• Regenerate lib/ts/package-lock.json to reflect the new dependency tree (removing extract-zip and older Puppeteer-era deps).

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File	Description
lib/ts/test/build.xml	Updates downloaded QUnit asset versions/URLs used by the TS test build.
lib/ts/package.json	Upgrades grunt-contrib-qunit and adds an override to select Puppeteer 25.8.0.
lib/ts/package-lock.json	Updates the resolved dependency graph to match the new dev dependency set (removing extract-zip).

Files not reviewed (1)

• lib/ts/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Jens-G]

Code review

No blocking issues found. Checked for bugs and CLAUDE.md compliance.

Two suggestions, below the bar for an issue but verified:

• This change needs a JIRA ticket. CONTRIBUTING.md: "All significant changes require an Apache Jira THRIFT Issue ticket. Trivial changes such as fixing a typo or a compiler warning do not." Moving grunt-contrib-qunit from 3.1 to 10.2 and Puppeteer from 1.20 to 25.8 changes about 55 package entries in the lockfile and the Node.js requirement of this test path. With a ticket, the title and the commit subject also get their THRIFT-NNNN: prefix; right now they don't match ("Remove extract-zip from TypeScript test dependencies" vs. "Update TypeScript QUnit dependencies").

thrift/CONTRIBUTING.md

Lines 15 to 17 in 5acac82

	1. All significant changes require an [Apache Jira THRIFT Issue](http://issues.apache.org/jira/browse/THRIFT) ticket. Trivial changes such as fixing a typo or a compiler warning do not.

• The Puppeteer override makes Node.js 22.12 the minimum for the lib/ts browser tests: puppeteer, puppeteer-core and @puppeteer/browsers all declare "node": ">=22.12.0" in the lockfile. Update JavaScript js-yaml dependencies #3724 refreshed the same lockfile and stated that it kept Node.js 16 compatibility. The PR description mentions the new floor, but nothing in the tree records it. Copilot's inline comment on this line is still unanswered.

thrift/lib/ts/package.json

Lines 39 to 43 in 5acac82

	"grunt-legacy-util": "2.0.2",
	"grunt-contrib-qunit": {
	"puppeteer": "25.8.0"
	},
	"jshint": {

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Unresolved dependency-installation and CI-validation issues remain.

Review details

Files not reviewed (1)

• lib/ts/package-lock.json: Generated file

Suppressed comments (2)

lib/ts/package-lock.json:58

• The new @puppeteer/browsers dependency declares yauzl as an optional ZIP extractor, but this lockfile leaves that peer uninstalled. Its browser download path therefore falls back to a system unzip executable; make -C lib/ts check can fail during Puppeteer's install/download step on minimal environments without unzip. Add yauzl as a development dependency (and regenerate the lockfile), or make unzip an explicit prerequisite for this test path.
  lib/ts/package.json:22
• This major tooling update is not exercised by the repository's automated tests: the build workflow's TypeScript step runs make -C lib/nodets check, while lib/ts is not included in lib/Makefile.am. Please add a CI invocation for this Grunt/Puppeteer path (with Node >=22.12) or an equivalent validation before relying on the new runner and QUnit assets.

    "grunt-contrib-qunit": "^10.2.0",

• Files reviewed: 2/3 changed files
• Comments generated: 0 new
• Review effort level: Lite