Security: fix eslint for DevExtreme

[sjbur]

No description provided.

[Copilot]

Pull request overview

Updates demo utility scripts to execute external tooling in a safer/more lint-compliant way (moving away from string-based shell execution) as part of a security/eslint fix.

Changes:

• ts-to-js-converter: switch TypeScript compilation from exec("tsc ...") to execFile(...) with argument arrays.
• create-bundles (Angular): switch Angular build invocation from exec(...) to spawn(...) with platform-specific command/args.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
apps/demos/utils/ts-to-js-converter/converter.ts	Uses execFile + argv arrays for running tsc during TS→JS conversion.
apps/demos/utils/create-bundles/Angular/bundler.ts	Uses spawn + argv arrays for running npm run build-angular during Angular demo bundling.

Comments suppressed due to low confidence (1)

apps/demos/utils/create-bundles/Angular/bundler.ts:59

• spawn can emit an error event (e.g. ENOENT when npm/cmd isn't found). In that case the close handler may never fire, so res() is never called and the batch processing hangs. Add an ngBuildProcess.on('error', ...) handler that reports the failure and resolves/rejects appropriately.

    const isWin = process.platform === 'win32';
    const [npmCmd, npmArgs] = isWin
      ? ['cmd', ['/c', 'npm.cmd', 'run', 'build-angular', '--', getProjectNameByDemo(demo)]]
      : ['npm', ['run', 'build-angular', '--', getProjectNameByDemo(demo)]];
    const ngBuildProcess = spawn(npmCmd, npmArgs);
    ngBuildProcess.stdout.on('data', (data) => {
      console.log(`stdout: ${data}`);
    });
    ngBuildProcess.stderr.on('data', (data) => {
      console.error(`stderr: ${data}`);
    });
    ngBuildProcess.on('close', (code) => {
      console.log(`child process exited with code ${code}`);
      res();
    });

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

apps/demos/utils/create-bundles/Angular/bundler.ts:59

• spawn(...) can emit an error event (e.g., if npm/cmd cannot be started). In that case, the close handler may never run and res() won’t be called, causing processDemo() to hang indefinitely. Add an ngBuildProcess.on('error', ...) handler that logs the error and calls res() (or otherwise terminates the batch).

    const ngBuildProcess = spawn(npmCmd, npmArgs);
    ngBuildProcess.stdout.on('data', (data) => {
      console.log(`stdout: ${data}`);
    });
    ngBuildProcess.stderr.on('data', (data) => {
      console.error(`stderr: ${data}`);
    });
    ngBuildProcess.on('close', (code) => {
      console.log(`child process exited with code ${code}`);
      res();
    });

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

apps/demos/utils/create-bundles/Angular/bundler.ts:54

• spawn() can emit an error event (e.g., if npm/npm.cmd is not found). Right now there is no ngBuildProcess.on('error', ...) handler, which can cause an unhandled error and prevent res() from being called. Add an error handler that logs/propagates the failure and resolves/rejects appropriately.

    const isWin = process.platform === 'win32';
    const npmCmd = isWin ? 'npm.cmd' : 'npm';
    const npmArgs = ['run', 'build-angular', '--', getProjectNameByDemo(demo)];
    const ngBuildProcess = spawn(npmCmd, npmArgs);
    ngBuildProcess.stdout.on('data', (data) => {
      console.log(`stdout: ${data}`);
    });
    ngBuildProcess.stderr.on('data', (data) => {
      console.error(`stderr: ${data}`);
    });

[sjbur]

I think it is not related to the current changes

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

apps/demos/utils/create-bundles/Angular/bundler.ts:58

• The Angular build result is treated as success regardless of whether npm run build-angular fails. The close handler always calls res() and ignores non-zero exit codes, and there’s also no error handler for cases like npm not being found (which would leave the Promise unresolved). Please propagate failures (e.g., reject/throw on code !== 0 and handle the error event) so the batching script can fail fast instead of continuing with broken bundles.

    const isWin = process.platform === 'win32';
    const npmCmd = isWin ? 'npm.cmd' : 'npm';
    const npmArgs = ['run', 'build-angular', '--', getProjectNameByDemo(demo)];
    const ngBuildProcess = spawn(npmCmd, npmArgs);
    ngBuildProcess.stdout.on('data', (data) => {
      console.log(`stdout: ${data}`);
    });
    ngBuildProcess.stderr.on('data', (data) => {
      console.error(`stderr: ${data}`);
    });
    ngBuildProcess.on('close', (code) => {
      console.log(`child process exited with code ${code}`);
      res();
    });