Bump typescript from 6.0.3 to 7.0.2

[dependabot]

Bumps typescript from 6.0.3 to 7.0.2.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[bgentry]

🤖 Codex review: Not approved because the compatibility gate fails.

Upgrade

• typescript: 6.0.3 → 7.0.2
• Reviewed head: b56e03772aee13677a0b7bedd229c0a5c9e4fc5a

Security review

• The direct package uses the canonical Microsoft TypeScript registry/repository identity, and its lockfile SHA-512 matches npm metadata.
• TypeScript 7 introduces the expected platform-specific native compiler packages. No install lifecycle hook is added, but this is a materially larger binary trust surface than TypeScript 6.

Compatibility verification

• npm ci fails with ERESOLVE: typescript-eslint@8.65.0 requires typescript >=4.8.4 <6.1.0.
• JS build/test, lint, release, and image checks consequently fail before useful project validation can run.
• This PR contains no independent dependency update to extract; every added lockfile package belongs to TypeScript 7's platform compiler distribution.

Residual risk / blocker

• Keep this PR unmerged until the lint/Astro toolchain declares TypeScript 7 compatibility and the native compiler artifacts can be validated as part of a viable update.

[bgentry]

🤖 Codex follow-up review: Not approved; the security and compatibility gates remain blocked.

Upgrade

• typescript: 6.0.3 → 7.0.2
• Reviewed head: b56e03772aee13677a0b7bedd229c0a5c9e4fc5a

Security review

• All 22 exact npm tarballs (the wrapper, old package, and 20 new platform packages) were inspected without execution. Their SHA-512 values match both npm metadata and the lockfile; no lifecycle hooks, non-registry URLs, same-version integrity rewrites, or suspicious wrapper behavior were found.
• TypeScript 7 newly executes platform-native compiler binaries. Both exact macOS binaries contain Microsoft Team ID UBF8T346G9 signatures, but codesign --verify --deep --strict --verbose=6 reports invalid signature (code or signature have been modified) for each.
• npm publishes no provenance attestations for these artifacts. The Linux/BSD/AIX PGP sidecars and Windows Authenticode signatures could not be independently verified in this environment. This does not prove compromise, but it leaves the new native-binary trust surface inconclusive.

Compatibility verification

• Exact-head CI fails during npm ci: typescript-eslint@8.65.0 requires TypeScript >=4.8.4 <6.1.0.
• JS build/test, lint, release, and downstream image jobs therefore do not reach meaningful validation.

Residual risk / blocker

• Do not merge until Microsoft explains or corrects the invalid macOS signatures, the remaining platform signatures can be validated as practical, and the lint/tooling stack explicitly supports TypeScript 7 with the full repository checks passing.

[bgentry]

Codex dependency security review — blocked for compatibility

Reviewed base bf8ecc606893e0a9a8fced4d6873a00b8ed14c03 through exact head b56e03772aee13677a0b7bedd229c0a5c9e4fc5a.

Supply-chain review is clear, with residual provenance risk. TypeScript 7.0.2 and its 20 platform-specific native packages use canonical npm registry artifacts with matching SHA-512 integrity and Microsoft-controlled publishers/source lineage. Representative Darwin arm64, Linux x64, and Windows x64 native tarballs match Microsoft's official GitHub release assets byte-for-byte. No lifecycle hooks, dynamic downloads, telemetry, credential access, non-registry sources, weak integrity, or same-version identity rewrites were found. No advisories apply to the changed TypeScript packages, so this is not a confirmed security update.

The update is nevertheless not mergeable. typescript-eslint 8.65.0 requires TypeScript >=4.8.4 <6.1.0, so npm ci deterministically fails with ERESOLVE. Current stable 8.69.0 and canary 8.69.1-alpha.0 retain the same <6.1.0 ceiling; upstream TypeScript 7 support remains blocked on the compiler's external API. There is no published direct-compatible pairing to substitute into this PR.

The repository configuration also needs a deliberate TypeScript 7 migration: ignoreDeprecations: "6.0" and baseUrl are rejected by TypeScript 7, path mappings must become project-root-relative, and the loss of tsserver requires editor/LSP validation. Microsoft's documented dual-installation workaround (TS6 API plus an aliased TS7 native compiler) changes the dependency graph and toolchain semantics enough to warrant a separate focused change rather than an automated bump.

Residual security risk centers on the major shift to native compiler executables and the lack of npm SLSA attestations. The macOS binary exactly matches Microsoft's release asset but fails strict embedded-signature verification, which should be resolved or documented before relying on it.

Because this PR contains only the incompatible TypeScript update, there is no safe subset to commit here. Recommendation: leave it unmerged and revisit TypeScript 7 as a dedicated migration once the lint/tooling ecosystem has a supported path.

[bgentry]

🤖 Codex review: Not approved because compatibility verification is blocked.

Upgrade

• typescript: 6.0.3 → 7.0.2
• Reviewed head: b56e03772aee13677a0b7bedd229c0a5c9e4fc5a

Security review

• No blocking supply-chain issue was identified. This is a major architecture/feature update, not a confirmed vulnerability fix.
• The lockfile adds 20 optional OS/CPU-specific TypeScript compiler packages plus two nested TypeScript 6 peer copies. All 22 added artifacts and both changed artifacts use registry URLs and SHA-512 integrity values; downloaded tarballs matched the lockfile and npm metadata.
• Every TypeScript 7 tarball also matched the corresponding official microsoft/typescript-go 7.0.2 release asset byte-for-byte by SHA-256 and the declared source identity.
• No lifecycle hooks, binary downloaders, update checks, credential harvesting, unexpected remote network clients, dynamic evaluation, or obfuscation were found. The root launcher performs the expected platform selection and process execution of the native compiler.

Compatibility verification — blocking

• Local npm ci on Node 24.14.1 / npm 11.11.0 fails with ERESOLVE: typescript-eslint@8.65.0 requires TypeScript >=4.8.4 <6.1.0, while the root requires ^7.0.2.
• The existing JS lint, JS build/test, release, and Docker checks fail at the same install conflict.
• The PR is currently conflicting with master (DIRTY).
• Lint, tests, builds, and Docker validation were not run because the clean locked install does not succeed.

Required before approval

• Rebase or recreate the PR and resolve the typescript-eslint compatibility range without --force or --legacy-peer-deps.
• Then rerun clean install, tsc, lint, tests, production build, Storybook/Vite integration, and Linux amd64/arm64 Docker builds.

Residual risk

• TypeScript 7 replaces the JavaScript compiler with platform-native binaries, removes the legacy public API and tsserver bin, and requires optional platform packages at runtime.
• The native binaries matched official release assets, but reproducible-build proof was unavailable; the release tag is unsigned and npm exposes no Sigstore provenance attestation.