[mpreyskurantov]

The shipped files don't change: js/, build/make-nojquery.js, build/replace-meta.js and .npmignore are untouched. Only dev tooling and CI change. peerDependencies.devextreme stays >=18.1.0.

DevExtreme tests: one version instead of a matrix

• devextreme and devextreme-dist are pinned to 26.1.6 in devDependencies; the peer range is unchanged
• Removed the 18.1 / 22.2 CI matrix and its lockfiles (js-test/18.1, js-test/22.2)
• js-test/test-deps.js always loads devextreme-dist/js/dx.all.js
• Renovate no longer updates devextreme, devextreme-dist and jquery; they're bumped by hand

net/Sample

• Gets jquery and devextreme-dist from the root package.json: libman.json points at ../../node_modules, and net/Sample/package.json and its lockfile are removed
• The dotnet-test-build action runs npm ci at the repo root
• The sample moves from devextreme-dist 23.2 to 26.1.6

Dev dependency bumps

Package	From	To
typescript	4.9.5	7.0.2
eslint	8.57.1	10.14.0
webpack	5.105.3	5.112.2
webpack-cli	4.10.0	7.3.1
qunit	2.19.3	3.0.0
karma-qunit	2.1.0	4.2.3
karma-chrome-launcher	2.2.0	3.2.0
@types/jquery	3.5.33	3.5.34
devextreme-dist	~25.2.3	26.1.6
devextreme	peer only	26.1.6 (devDependency)

• npm run dts now passes --types jquery --strict false, because TS 6+ no longer loads @types packages automatically and is strict by default
• ESLint uses a flat config (eslint.config.js):
  • The rules are the same, and js/ is still limited to ES5
  • The /* eslint-env */ comments are replaced by config globals
  • no-unused-vars keeps caughtErrors: "none", because ES5 needs the catch(x) variable

npm audit: 12 (1 high, 11 moderate) → 6 moderate

• follow-redirects 1.16.1 → 1.16.2 (GHSA-mrwp-f3q8-3g9p, high)
• minimatch → 11.0.4 under eslint, via overrides (GHSA-g3hv-75wg-m249)
• Dropped the qs override; body-parser now requires a fixed qs itself
• The 6 left are minimatch 3.1.5 under karma, karma-coverage and glob 7:
  • The advisory range (<11.0.1) is too broad: 3.x doesn't contain the affected firstPhasePreProcess() code
  • An override can't fix it: v11 can't be called as a function from CommonJS, which karma relies on, and karma is deprecated, so no new release will fix it

Testing

Run locally:

• npm run eslint and npm run dts
• All four karma suites: 56/56 each
• dotnet build net/Sample: libman restores devextreme 26.1.6 and jquery 3.7.1 from the root

Note

CI doesn't set a Node version. ESLint 10 needs Node ≥ 20.19, and webpack-cli 7 needs ≥ 20.9.

[Copilot]

🟢 Approval recommended

No active review issues block approval of the tooling and test-configuration updates.

No open issues 🎉

1 file not reviewed

• net/Sample/package-lock.json: Generated file

What changed in this PR

Simplifies DevExtreme testing and modernizes development tooling without changing shipped JavaScript or the supported peer dependency range.

Changes:

• Pins development dependencies to DevExtreme 26.1.6 and replaces the CI version matrix with a single test version.
• Updates JavaScript tooling and migrates ESLint to flat configuration while retaining ES5 checks for js/.
• Reuses root npm dependencies for the .NET sample and disables automated DevExtreme and jQuery updates.

File	Description
renovate.json	Disables automated DevExtreme and jQuery updates.
package.json	Updates tooling, pins DevExtreme, and adjusts TypeScript commands and overrides.
net/​Sample/​package.json	Removes the sample-specific dependency manifest.
net/​Sample/​package-lock.json	Removes the sample-specific lockfile.
net/​Sample/​libman.json	Restores sample assets from root node_modules.
js-test/​webpack.config.js	Removes the legacy ESLint environment comment.
js-test/​test.js	Replaces the browser environment comment with explicit globals.
js-test/​test-deps.js	Always loads the DevExtreme distribution bundle.
js-test/​karma.conf.js	Removes the legacy ESLint environment comment.
eslint.config.js	Adds flat configuration with rules, globals, and ignores.
build/​.eslintrc.json	Removes the legacy build-specific ESLint configuration.
.github/​workflows/​ci.yml	Removes the DevExtreme matrix and lockfile switching.
.github/​actions/​dotnet-test-build/​action.yml	Installs npm dependencies at the repository root.
.eslintrc.json	Removes the legacy root ESLint configuration.
.eslintignore	Moves ignore patterns into flat configuration.

_{Review effort: Balanced}