chore: bump typescript from 5.9.3 to 7.0.2

[dependabot]

Bumps typescript from 5.9.3 to 7.0.2.

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

[claude]

Claude finished @dependabot[bot]'s task in 3m 28s —— View job

---

Dependency review: typescript 5.9.3 → 7.0.2

Verdict: crosses two majors (5 → 7, skipping 6) and switches to the native Go compiler. tsconfig.json is untouched and CI is green, so this looks mergeable — but there is one runtime behaviour CI cannot see that I'd verify by hand first.

What changed

typescript is a devDependency, used only as npm run build → tsc. The lockfile adds 20 optional platform binaries (@typescript/typescript-<os>-<cpu>) and drops the tsserver bin. typescript's own engines.node moves >=14.17 → >=16.20.0; the repo floor is >=22, so no conflict.

Compatibility check against this repo

Concern	Status
strict: true not weakened	✅ tsconfig.json unchanged in this diff
ESM NodeNext + .js extensions on relative imports	✅ preserved (src/index.ts:2-8)
Flags removed in TS 6.0 (out, charset, keyofStringsOnly, importsNotUsedAsValues, target: ES3/ES5, …)	✅ none present — tsconfig uses only target: ES2022, module/moduleResolution: NodeNext, outDir, rootDir, strict, esModuleInterop, resolveJsonModule, declaration, sourceMap, skipLibCheck, types
TypeScript compiler API / custom transformers	✅ not used anywhere — scripts/*.ts run under tsx and tests under vitest, both esbuild, so tsc's only consumer is src/
CI	✅ build + 9 test files + .mcpb pack all pass on Node 22 and 24 (run)
Dependabot ignore rules	✅ working as configured — .github/dependabot.yml:24 only pins @types/node majors, so a TypeScript major arriving is expected, not a broken rule

⚠️ The one thing to verify: does catalog.json still land in dist/?

src/index.ts:8 does import catalog from "./catalog.json" with { type: "json" } under resolveJsonModule: true. At runtime node dist/index.js needs dist/catalog.json to physically exist, and today that depends on tsc copying JSON files from rootDir into outDir. I have no confirmation that the native port preserves that emit, and nothing in CI would catch it if it didn't:

• npm run build only compiles — it does not assert the output shape.
• test/catalog.test.ts:2 imports ../src/catalog.json, i.e. the source copy, never dist/.
• pack:mcpb zips dist/ but never runs it, so the smoke test stays green either way.

If TS 7 dropped the JSON copy, CI passes and the published npm package plus the .mcpb bundle both break on startup. I could not run npm ci in this sandbox to settle it, so please check locally:

npm ci && npm run build && ls -l dist/catalog.json && node dist/index.js < /dev/null

If it's missing, the fix is a copy step in build. Either way this gap predates the bump and is worth closing permanently — a CI assertion on dist/catalog.json after the build step would make any future compiler swap fail loudly instead of silently. Fix this →

Minor notes

• tsserver bin removed — see the inline comment on package.json:47. Editors set to "use workspace TypeScript version" lose the language server; TS 7 ships an LSP instead.
• Release notes gap — the PR body only links the 6.0.x notes; Dependabot surfaced nothing for 7.0. Worth reading the TS 7 announcement before merging, since the type checker is a full rewrite and equivalence with 5.x is a goal rather than a guarantee. (My WebFetch access was denied in this run, so I reviewed against the lockfile diff and CI rather than the notes themselves.)
• New npm releaser (microsoft1es) flagged by Dependabot — expected for Microsoft's pipeline change, but it does mean the trust anchor for this package moved.

Suggested follow-up

1. Run the dist/catalog.json check above before merging.
2. Consider making the .mcpb smoke test actually boot dist/index.js (it already exits cleanly on a closed stdin), turning a pack test into a real startup test.
   · branch dependabot/npm_and_yarn/typescript-7.0.2

[claude]

This crosses two majors (5 → 7, skipping 6 entirely) and swaps the JS compiler for the native Go port. Two things visible in the lockfile diff that are worth knowing before merge:

• tsserver is gone from bin (tsc is the only bin now). Anyone whose editor is set to "use workspace TypeScript version" will lose language-server support until they switch to the TS 7 LSP.
• 20 new optional platform binary packages (@typescript/typescript-<os>-<cpu>) are now install-time deps. npm ci --omit=optional, or any platform not in that list, leaves tsc with no binary to run.

Neither blocks the bump — CI is green on Node 22 and 24 — but see the top-level comment for the one behaviour I'd verify manually.