Tracking issue for a deliberate dependency pin that should be undone when upstream catches up.
Why the hold exists
openapi-typescript@7.13.0 — the latest release — peer-requires typescript: ^5.x. When the worker-npm-dependencies group bumped TypeScript to 7.x, the resulting tree could not resolve and every npm ci failed, wedging the weekly dependabot PR from 2026-06-15 onward (#440).
main was never broken: cloudflare-worker/package.json pins typescript: ^5.9.3. Only dependabot's own tree was unresolvable.
Verified both directions before pinning:
typescript@^7.0.2 → ERESOLVE, peer typescript@"^5.x" from openapi-typescript@7.13.0typescript@^5.9.3 plus the group's other four bumps (@cloudflare/vitest-pool-workers 0.20.2, @cloudflare/workers-types 5.20260804.1, vitest 4.1.10, wrangler 4.119.0) → resolves cleanly
PR #542 added an ignore for major TypeScript bumps to the /cloudflare-worker entry in .github/dependabot.yml.
What to do when upstream ships TS 7 support
- Delete the
ignore block from the /cloudflare-worker entry in .github/dependabot.yml (it carries a comment pointing here).
- Let the group PR bump TypeScript, and confirm
npm ci and npm test pass in cloudflare-worker/.
Watch openapi-typescript's peer range — the relevant signal is its peerDependencies.typescript widening past ^5.x:
npm view openapi-typescript version peerDependencies
Immediate follow-up
PR #440 is still open and red. The dependabot config change only takes effect once #542 is on main; commenting ·@·d·ependabot r·ecreate before then just regenerates the same failing PR. After #542 merges, either close #440 or recreate it — the fresh group PR will exclude TypeScript.
Note @cloudflare/workers-types 4 → 5 is a major bump in that group. Clean dependency resolution is not the same as a green build, so its CI is the real test.
Tracking issue for a deliberate dependency pin that should be undone when upstream catches up.
Why the hold exists
openapi-typescript@7.13.0— the latest release — peer-requirestypescript: ^5.x. When theworker-npm-dependenciesgroup bumped TypeScript to 7.x, the resulting tree could not resolve and everynpm cifailed, wedging the weekly dependabot PR from 2026-06-15 onward (#440).mainwas never broken:cloudflare-worker/package.jsonpinstypescript: ^5.9.3. Only dependabot's own tree was unresolvable.Verified both directions before pinning:
typescript@^7.0.2→ERESOLVE,peer typescript@"^5.x" from openapi-typescript@7.13.0typescript@^5.9.3plus the group's other four bumps (@cloudflare/vitest-pool-workers0.20.2,@cloudflare/workers-types5.20260804.1,vitest4.1.10,wrangler4.119.0) → resolves cleanlyPR #542 added an
ignorefor major TypeScript bumps to the/cloudflare-workerentry in.github/dependabot.yml.What to do when upstream ships TS 7 support
ignoreblock from the/cloudflare-workerentry in.github/dependabot.yml(it carries a comment pointing here).npm ciandnpm testpass incloudflare-worker/.Watch
openapi-typescript's peer range — the relevant signal is itspeerDependencies.typescriptwidening past^5.x:Immediate follow-up
PR #440 is still open and red. The dependabot config change only takes effect once #542 is on
main; commenting·@·d·ependabot r·ecreatebefore then just regenerates the same failing PR. After #542 merges, either close #440 or recreate it — the fresh group PR will exclude TypeScript.Note
@cloudflare/workers-types4 → 5 is a major bump in that group. Clean dependency resolution is not the same as a green build, so its CI is the real test.