build(deps-dev): bump typescript from 6.0.3 to 7.0.2 in the typescript group across 1 directory

[dependabot]

Bumps the typescript group with 1 update in the / directory: typescript.

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

---

Note

Medium Risk
Major TypeScript version jump with no application code changes, but tooling peer-deps (typescript-eslint) may not officially support TS 7 yet, which could surface type-check or lint issues in CI.

Overview
Bumps the root devDependency typescript from 6.0.3 to 7.0.2 in package.json, with the corresponding package-lock.json refresh.

TypeScript 7’s package layout changes show up in the lockfile: optional per-platform @typescript/typescript-* binaries, a higher Node requirement (>=16.20.0), and the published bin entry is now only tsc (no tsserver in the root typescript package).

Compatibility note: typescript-eslint 8.63.0 still declares typescript peer range >=4.8.4 <6.1.0, so this upgrade sits outside what ESLint’s TypeScript tooling officially supports until that stack is updated. CI lint / tsc are the main places to validate.

^{Reviewed by Cursor Bugbot for commit 893524d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale comment

Injected PR Evaluation: Web Compatibility & Security

PR: build(deps-dev): bump typescript from 6.0.3 to 7.0.2 (4fb55cd)
Scope: 2 files — package.json, package-lock.json only. No injected/, messaging/, special-pages/, or application source changes.

---

Web Compatibility Assessment

File	Lines	Severity	Finding
—	—	info	No changes to injected/src/, wrapper-utils.js, captured-globals.js, messaging transports, or any API override/shim code.
package.json	57	info	typescript is a root devDependencies entry used for npm run tsc, tsc-strict-core, and ESLint type-aware rules. Root tsconfig.json sets "noEmit": true — TypeScript is not used to emit runtime bundles. Injected code is bundled via esbuild. No browser-facing API surface is affected.

---

Security Assessment

File	Lines	Severity	Finding
—	—	info	No changes to captured-globals.js, message bridge, origin validation, nativeData handling, or any injection-runtime code path.
package.json	57	info	TypeScript compiler is build/lint tooling only; it is not shipped to end-user browsers or WebViews. No new attack surface in the hostile page environment.

---

Risk Level

Low Risk — devDependency-only major version bump with zero changes to injected runtime, messaging, or API override code.

---

Recommendations

1. (warning — CI blocker, not runtime) npm ci fails on this PR. Peer dependency conflicts:

   • typedoc@0.28.20 requires typescript@"5.0.x … \|\| 6.0.x" (no TS 7)
   • typescript-eslint@8.63.0 requires typescript@">=4.8.4 <6.1.0"
   • CI jobs (build, unit, production-deps, snapshots) are already failing at the install step.

2. (info) TypeScript 7.0 ships the Go-based tsc but does not yet expose the programmatic compiler API that typescript-eslint and typedoc depend on (expected in TS 7.1). Even forcing install with --legacy-peer-deps would likely crash npm run lint at runtime.

3. (info) If the team wants TS 7 compiler speed now, Microsoft recommends a side-by-side setup: keep typescript pinned to @typescript/typescript6 for ESLint/TypeDoc, and add @typescript/native (npm alias to typescript@^7.0.2) for tsc — see Announcing TypeScript 7.0.

4. (info) Recommend closing or ignoring this Dependabot PR until typescript-eslint and typedoc publish TS 7–compatible releases, then re-evaluate with a deliberate migration plan rather than a bare version bump.

Verdict: Safe from a web-compatibility and injection-security perspective, but not merge-ready due to ecosystem peer-dependency breakage. No injected-runtime concerns.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Confirmed blocker: This single-line bump pulls in typescript@7.0.2, which is outside the peer range of both typedoc@0.28.20 (<=6.0.x) and typescript-eslint@8.63.0 (<6.1.0). npm ci fails with ERESOLVE on a clean install — CI never gets past dependency install.

[cursor]

Stale comment

Injected PR Evaluation: Web Compatibility & Security

Re-assessed on synchronize (f3241bcdb) after merge with main. Diff unchanged: devDependency-only TypeScript bump (6.0.3 → 7.0.2) in package.json + package-lock.json. No changes to injected/, messaging/, special-pages/ source, or runtime bundles.

Web Compatibility Assessment

No findings.

This PR does not modify injected feature code, wrapper utilities, API overrides, DOM interaction, messaging, or platform entry points. TypeScript is a root-level devDependency used for tsc type-checking (noEmit: true) and lint tooling — it is not bundled into content-scope scripts shipped to browsers (injected bundles via esbuild).

Security Assessment

No findings.

No changes to captured-globals.js, message bridge trust boundaries, origin validation, nativeData handling, config gating, or any runtime security-sensitive code paths.

Risk Level

Low Risk — dependency-only dev tooling bump with zero runtime code changes; no web compatibility or security surface area in the injection layer.

Recommendations

1. Do not merge as-is (CI blocker — install): npm ci fails with ERESOLVE because typedoc@0.28.20 peer-dep caps TypeScript at <=6.0.x. Verified locally on this commit.

2. Do not merge as-is (CI blocker — lint): eslint crashes at import time with TypeError: Cannot read properties of undefined (reading 'Cjs') — typescript-eslint@8.63.0 peers require typescript <6.1.0 and its programmatic API is incompatible with TS 7.

3. Do not merge as-is (CI blocker — typecheck): Even bypassing peer deps (npm install --legacy-peer-deps), npm run tsc reports 340 errors across 107 files (TS 6.0.3 passes cleanly). Dominant new failures: TS18047 (possibly-null CSS module imports), TS2749/TS1340 (JSDoc import() type syntax stricter in TS 7). These are lint/CI issues, not runtime regressions, but block the standard npm run lint pipeline.

4. Recommended path: Close or hold this PR and add a Dependabot ignore for typescript version-update:semver-major until the ecosystem catches up (typedoc, typescript-eslint TS 7 support) and the ~107-file JSDoc/typecheck fallout is addressed. A draft branch (cursor/ignore-typescript-7-dependabot-updates) already sketches this approach.

5. If migrating later: TypeScript 7 recommends side-by-side @typescript/native (TS 7) + @typescript/typescript6 for tools still on the v6 API; update tsconfig.json ignoreDeprecations from "6.0" when ready.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Confirmed blocker: typedoc@0.28.20 peers require typescript <= 6.0.x and typescript-eslint@8.63.0 requires <6.1.0. npm ci fails with ERESOLVE on this line change alone — CI never reaches build/test.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b45bbb4. Configure here.}

[cursor]

Peer deps exclude TypeScript seven

Medium Severity

Raising dev typescript to ^7.0.2 without updating adjacent tooling leaves declared peer ranges that exclude 7.x. typescript-eslint@8.63.0 expects typescript below 6.1.0, and typedoc@^0.28.20 only lists through 6.0.x. That mismatch affects eslint.config.js type-aware lint and the docs / docs-preview scripts run in CI.

 

^{Reviewed by Cursor Bugbot for commit b45bbb4. Configure here.}

[cursor]

Stale comment

Dependency review: TypeScript 6.0.3 → 7.0.2

Recommendation: Do not merge. This major bump is blocked by toolchain peer dependencies, runtime crashes, and 340 new tsc errors. Close this PR and merge a Dependabot ignore rule instead (see fix PR on branch cursor/dependency-update-risk-review-c468).

---

Confirmed blockers

1. npm ci fails (CI red) — typedoc@0.28.20 declares peer typescript@"5.0.x … || 6.0.x". npm refuses to resolve TS 7.0.2. All build/unit/snapshot jobs fail at install time.

2. ESLint crashes at import time — With --legacy-peer-deps, eslint . throws:

   TypeError: Cannot read properties of undefined (reading 'Cjs')
   

   Root cause: typescript-eslint@8.63.0 peers cap TypeScript at <6.1.0. Latest typescript-eslint@8.65.0 still caps at <6.1.0.

3. TypeDoc crashes at runtime — npm run docs throws:

   TypeError: Cannot read properties of undefined (reading 'PropertyDeclaration')
   

   TypeDoc 0.28.x uses the JS Compiler API, which is incompatible with the TS 7 Go-based compiler package.

4. 340 new tsc errors (0 on TS 6.0.3) — Validated locally with npm ci --legacy-peer-deps && npx tsc:

   Code	Count	Likely cause
   TS18047	114	Stricter nullability (TS 7 adopts 6.0 defaults)
   TS2749	98	JSDoc @typedef values used as types
   TS1340	24	JSON imports used as types (resolveJsonModule)
   TS2322	34	Stricter assignability

   tsconfig.json still sets ignoreDeprecations: "6.0" and alwaysStrict: true — both are hard errors / removed in TS 7 per the TS 7.0 announcement.

---

Changelog / behavioral impacts (TS 7.0)

Per the official release notes, TS 7 is primarily a Go compiler rewrite (10× faster), not a language version bump. Key migration risks for this repo:

• Hard errors for deprecated tsconfig flags — ignoreDeprecations is no longer accepted; alwaysStrict: false is disallowed.
• New defaults inherited from TS 6.0 — strict: true, noUncheckedSideEffectImports: true, types: [] (repo currently uses types: ["*"]).
• Compiler API consumers break — TypeDoc and potentially ts-json-schema-generator rely on the JS typescript package API; TS 7's Go port does not ship a drop-in Compiler API.

---

Test coverage

• CI lint (npm run lint → tsc + tsc-strict-core + ESLint) is the primary gate — it never runs on this PR because install fails.
• No dedicated tests exist for TypeScript version compatibility; the existing suite provides good behavioral coverage but cannot catch peer-dep or compiler-API breakage.
• Gap: no CI check that npm ci peer resolution stays valid across dependency groups.

---

Is TypeScript still needed?

Yes. TypeScript is essential here:

• Root npm run lint runs tsc and tsc-strict-core across all workspaces.
• checkJs: true type-checks the large JS codebase.
• typedoc, ts-json-schema-generator, and typescript-eslint all depend on it.

There is no viable alternative in-repo; the right path is staying on TS 6.x until the toolchain catches up.

---

Supply chain risk

• Package provenance: typescript@7.0.2 is published by Microsoft from github.com/microsoft/TypeScript with a valid npm integrity hash. Low impersonation risk.
• Implementation risk (medium): TS 7 is a ground-up Go rewrite of the compiler. Same package name, very different internals. Ecosystem tools that import typescript and use the Compiler API are the main risk surface — confirmed broken for TypeDoc and typescript-eslint in this repo.
• Transitive change: lockfile reshuffles @typescript-eslint/* into nested duplicates under typescript-eslint/ due to peer mismatch — increases install complexity without benefit.

---

Fix proposed

Opened a separate PR from cursor/dependency-update-risk-review-c468 adding a Dependabot ignore for typescript semver-major updates (same approach as draft #2897). This prevents recurring failed TS 7 bumps until:

1. typedoc and typescript-eslint publish TS 7-compatible releases
2. tsconfig.json is migrated off deprecated flags
3. The 340 tsc errors are resolved

---

Review performed by Cursor dependency-update automation.

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Confirmed blocker: This single-line bump cascades into install failure. typedoc@0.28.20 peers require typescript <= 6.0.x, so npm ci exits with ERESOLVE and every CI job fails before tests run. Even with --legacy-peer-deps, ESLint and TypeDoc crash at runtime due to typescript-eslint and TypeDoc relying on the JS Compiler API that TS 7 no longer provides.

[cursor]

Injected PR Evaluation: Web Compatibility & Security

Re-assessed on synchronize (893524da). Diff unchanged in substance: devDependency-only TypeScript bump (6.0.3 → 7.0.2) in package.json + package-lock.json. No changes to injected/, messaging/, special-pages/ source, or runtime bundles.

Web Compatibility Assessment

No findings.

This PR does not modify injected feature code, wrapper utilities, API overrides, DOM interaction, messaging, or platform entry points. TypeScript is a root-level devDependency used for tsc type-checking (noEmit: true) and lint tooling — it is not bundled into content-scope scripts shipped to browsers (injected bundles via esbuild).

File	Lines	Severity	Finding
—	—	info	No changes to injected/src/, wrapper-utils.js, captured-globals.js, messaging transports, or any API override/shim code.
package.json	57	info	typescript is build/lint tooling only; no browser-facing API surface is affected.

Security Assessment

No findings.

File	Lines	Severity	Finding
—	—	info	No changes to captured-globals.js, message bridge, origin validation, nativeData handling, or any injection-runtime code path.
package.json	57	info	TypeScript compiler is not shipped to end-user browsers or WebViews. No new attack surface in the hostile page environment.

Risk Level

Low Risk — dependency-only dev tooling bump with zero runtime code changes; no web compatibility or security surface area in the injection layer.

Recommendations

1. Do not merge as-is (CI blocker — install): npm ci fails with ERESOLVE. Peer dependency conflicts:

   • typedoc@0.28.20 requires typescript@"5.0.x … || 6.0.x" (no TS 7)
   • typescript-eslint@8.63.0 requires typescript@">=4.8.4 <6.1.0"
   • All CI jobs fail at install.

2. Do not merge as-is (CI blocker — lint): Even with --legacy-peer-deps, eslint crashes at import time: TypeError: Cannot read properties of undefined (reading 'Cjs') — typescript-eslint programmatic API is incompatible with TS 7.

3. Do not merge as-is (CI blocker — typecheck): npm run tsc reports 340 errors across 107 files (TS 6.0.3 passes cleanly). Dominant new failures: TS18047 (possibly-null CSS module imports), TS2749/TS1340 (JSDoc import() type syntax stricter in TS 7). These are lint/CI issues, not runtime regressions.

4. Recommended path: Close or hold this PR and add a Dependabot ignore for typescript version-update:semver-major until typedoc and typescript-eslint publish TS 7–compatible releases and the ~107-file typecheck fallout is addressed.

5. If migrating later: TypeScript 7 recommends side-by-side @typescript/native (TS 7) + @typescript/typescript6 for tools still on the v6 API.

Verdict: Safe from a web-compatibility and injection-security perspective, but not merge-ready due to ecosystem peer-dependency breakage and 340 new type errors.

  

_{Sent by Cursor Automation: Web compat and sec}

[cursor]

Dependency review: TypeScript 6.0.3 → 7.0.2

Verdict: Do not merge. This is a major-version jump to the new native TypeScript 7 compiler. The bump breaks CI at npm ci and would require coordinated toolchain + source fixes before adoption.

---

Confirmed blockers (reproduced locally)

1. npm ci fails with ERESOLVE — typedoc@0.28.20 peers cap TypeScript at <=6.0.x. CI build, unit, production-deps, and snapshots jobs all fail at install (same error as run 30261192386).

2. typescript-eslint@8.63.0 is incompatible — peer range is >=4.8.4 <6.1.0. When install is forced (--legacy-peer-deps), npm run lint crashes at ESLint import time:

   TypeError: Cannot read properties of undefined (reading 'Cjs')
   at ...@typescript-eslint/typescript-estree/dist/create-program/shared.js:59
   

   This blocks the repo's primary lint gate (eslint . && tsc && ...).

3. TypeDoc crashes at runtime against TS 7:

   TypeError: Cannot read properties of undefined (reading 'PropertyDeclaration')
   at typedoc/dist/index.js:537
   

   TypeDoc uses the TypeScript Compiler API, which is not available in TS 7.0 (deferred to 7.1 per release notes).

4. tsc reports 340 new errors (0 on TS 6.0.3 / main). Top error codes:

   Code	Count	Likely cause
   TS18047	114	Stricter nullability (possibly null)
   TS2749	98	Value used as type (JSDoc import() patterns)
   TS2322	34	Type assignment mismatches
   TS1340	24	Module import used as type (JSON/locale imports)
   TS2339	17	Missing properties on inferred types

   Affected areas include click-to-load.js (~80 nullability errors), integration-test page objects, special-pages/, and broker-protection/utils/safe-call.js (JSDoc union T|PirError parse errors, TS1005).

5. tsconfig.json uses ignoreDeprecations: "6.0" — this escape hatch is removed in TS 7.0 per the TS 6.0 release notes; deprecated options become hard errors.

---

Changelog / behavioral impact

Per the TypeScript 7.0 announcement:

• Native Go-based compiler (~10× faster) but not a drop-in for TS 6
• Adopts TS 6.0 default changes (strict: true, types: [], etc.)
• Removes deprecated moduleResolution modes, baseUrl, ignoreDeprecations, etc.
• Compiler API unavailable in 7.0 — breaks tools that import typescript (TypeDoc, typescript-eslint, ts-json-schema-generator)

This repo relies on TypeScript as a dev-time type checker (JSDoc + tsc), not as a runtime dependency. The production bundles use esbuild; runtime behavior is unaffected. The risk is entirely in the developer toolchain and CI gates.

---

Test coverage assessment

• No tests exercise TypeScript version compatibility. Coverage comes from npm run lint (tsc + tsc-strict-core + ESLint) and build scripts.
• tsc-strict-core still passes on TS 7 (CORE_FILES subset), masking ~340 errors in non-core files/integration tests.
• Unit and integration tests never run if npm ci fails, so this PR provides no signal on runtime regressions.

---

Is TypeScript still needed?

Yes. TypeScript is essential here for:

• tsc / tsc-strict-core JSDoc type checking across injected/, special-pages/, messaging/
• ESLint via typescript-eslint
• typedoc docs generation
• ts-json-schema-generator in types-generator/

There is no viable alternative in this monorepo today. The right path is to stay on TS 6.x until the ecosystem catches up.

---

Supply chain risk

• Package: typescript@7.0.2 from registry.npmjs.org, published by Microsoft (types publisher)
• Integrity: sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==
• Risk level: Low for supply-chain tampering — official package, no suspicious dependency changes in this PR (only package.json + lockfile for the version bump)
• Operational risk: High — major breaking release with incomplete ecosystem support

---

Recommended action

1. Close or hold this PR until toolchain peers support TS 7 (TypeDoc, typescript-eslint, ts-json-schema-generator) and TS 7.1 restores the Compiler API.
2. Add a Dependabot ignore for typescript semver-major updates to stop repeat PRs.

A fix PR already exists: #2905 (chore(dependabot): ignore TypeScript major updates until toolchain supports v7). Similar drafts #2896/#2897 were opened by earlier automation runs; #2905 is the canonical follow-up.

Uncertain / needs validation before future adoption

• Whether ts-json-schema-generator@2.9.0 works once peers are updated (not tested — blocked by install failure)
• Exact effort to fix 340 tsc errors vs. waiting for ecosystem + TS 7.1
• Whether emitDecoratorMetadata / decorator frameworks behave correctly under the native compiler (advisory in TS 7 migration guides)

  

_{Sent by Cursor Automation: Review dependabot}

[cursor]

Confirmed blocker: This single-line bump from ^6.0.3 to ^7.0.2 is a major-version jump to the native TS 7 compiler. It breaks npm ci (typedoc peer conflict), ESLint (typescript-eslint Compiler API crash), TypeDoc runtime, and introduces 340 new tsc errors. Recommend closing this PR and merging #2905 to ignore semver-major TypeScript updates until the toolchain supports v7.