Repository navigation
chore: bump typescript from 5.9.3 to 7.0.2 - #45
Merged
Merged
Conversation
dependabot
Bot
added
dependencies
|
Claude finished @dependabot[bot]'s task in 2m 10s —— View job Dependency review —
|
| Change | Impact on this repo |
|---|---|
tsserver dropped from bin (tsc is the only bin) |
Dev-only. Editors set to "use workspace TypeScript version" lose the language server until switched to the TS 7 LSP. Nothing in CI or the published package uses it. |
20 new optional @typescript/typescript-<os>-<cpu> platform binaries |
npm ci in all three workflows is unflagged, so they install. npm ci --omit=optional — or a platform outside that list — leaves tsc with no binary. |
| JS compiler API replaced by the Go port | No impact: grep finds no programmatic import … from "typescript" anywhere in src/, test/, or scripts/. tsx (esbuild) and vitest (strips types) don't route through tsc. |
typescript engines is >=16.20.0 |
No conflict with either Node floor (engines.node >=22 consumer, 22.12 dev). |
Nothing ships to consumers: typescript is a devDependency and files: ["dist"].
Two notes that aren't blockers:
- New npm releaser. Dependabot flags that 7.0.2 was pushed by
microsoft1es, a releaser new to this package, and 20 new install-time packages arrive with it. The 7-daycooldownin.github/dependabot.ymlapplied, so this isn't a same-day release. - Checker parity. TS 7 is a rewrite, not a port of the checker's every edge case. Current code passes, but expect occasional diagnostic differences on future changes rather than breakage today.
Dependabot's ignore rules are intact — majors are only ignored for @types/node (.github/dependabot.yml:44), so a typescript major arriving here is expected behaviour, not a broken rule. @types/node stays at ^22.12.0, still tracking the consumer floor's major.
Suggested follow-up (optional, not blocking)
Add a line to CONTRIBUTING.md telling contributors that tsserver is gone in TS 7 and their editor needs the TypeScript 7 LSP — otherwise the first person to pull this gets a silently dead language server with no explanation in the repo. Fix this →
Verdict: safe to merge on the evidence available. The one thing CI cannot exercise is local editor tooling, which is where the only real regression lives.
· Branch
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/typescript-7.0.2
branch
from
August 13, 2026 12:49
f7eabd3 to
4ccdad8
Compare
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Contributor
|
@dependabot rebase |
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/typescript-7.0.2
branch
from
October 22, 2026 07:12
4ccdad8 to
b071cdb
Compare
AlexKantor87
pushed a commit
that referenced
this pull request
Oct 22, 2026
…llow-ups (#90) Closes #89. Supersedes #83 (folded in as its own commit, `b3d6841`). ## Why Every push re-ran a full Opus review. Each round found fresh nits instead of checking whether the last round's findings were fixed: 6 full runs on #87, 3 on #45 for an unchanged dependency diff. ## What changes - **Triggers:** adds `ready_for_review` and skips drafts. The fork guard stays on every job. - **Rebase detection:** on `synchronize`, a shell step compares the PR's own diff with the previous push's using `git patch-id`. A pure rebase onto newer `main` runs no review in any job. If the old SHA can't be fetched after a force-push, the step assumes the diff changed. - **Dependabot / catalog jobs:** run their full review again only when their diff changed. - **General job:** a full review on open. Later pushes get a Sonnet follow-up scoped to the new commits: `git diff BEFORE AFTER`, or `git range-diff` after a rebase so main's changes aren't included. It reports resolved / partially addressed / not addressed for earlier findings, resolves fixed threads, and flags only bugs, security issues and regressions. If the first full review was cancelled, it reviews the whole PR instead. - **Full review prompt:** adds a "what not to report" section, cuts Phase 3 to one sentence, and lets the reviewer read CI results with `gh pr checks` instead of running `npm`. - **Outdated rules in the prompt:** the general prompt now points at `CLAUDE.md` instead of restating it. The restated list said `org` falls back to `config.org`, the opposite of the rule, and left the version out of `User-Agent`. The dependency prompt now says tools are registered in `src/server.ts`. - `CLAUDE.md` documents the phasing. ## Testing - Rebase detection was tested in a throwaway repo: a pure rebase compared equal, a real change differed, and `range-diff` output was checked. - `actionlint` (with shellcheck) passes. ## Needs a manual review The action refuses to run when its workflow differs from the default branch (see `CLAUDE.md`, #33), so **this PR can't review itself**. It takes effect after merge; check the first follow-up run on the next PR. Points to look at: - **Model:** the follow-up uses `claude-sonnet-5-5`; the full reviews stay on `claude-opus-5`. - **Thread resolving:** not confirmed that the job's `pull-requests: write` is enough for the GraphQL `resolveReviewThread` mutation. If it isn't, threads stay open and the rest still works. - **`gh api` access:** the follow-up allows `Bash(gh api:*)`, as in the CLI repo's workflow. The token is limited to `contents: read` and `pull-requests: write`. - **Limits:** the follow-up is capped at 30 turns and $2; the full reviews keep 60.
dangrondahl
added a commit
that referenced
this pull request
Oct 22, 2026
…pendabot (#87) Gives more confidence before the next release by adding checks for things that so far were only tested by unit tests, or not at all. The new checks immediately turned up two bugs that were already on `main`, and both are fixed here: a mistyped test, and a `.mcpb` bundle that doesn't start on Node 22.0–22.6. ## Fix: the `.mcpb` bundle didn't start on Node 22.0–22.6 `pack-mcpb.sh` deleted `package.json` from the bundle, so nothing declared `dist/` as ESM. Node 22.7+ detects ESM from the syntax and prints a warning. Earlier versions parse the file as CommonJS and fail with `Cannot use import statement outside a module`. Both `engines` and `manifest.json` allow those versions. The bundle now ships a one-line `package.json` with `{ "type": "module" }`, and nothing from the repo's own `package.json`. I reproduced the failure on the official Node 22.6.0 binary, and confirmed the fixed bundle starts on 22.0.0, 22.6.0 and 22.7.0. ## Type-check tests and scripts `tsconfig.json` is `src`-only because it emits `dist/`, and vitest strips types without checking them. So a type error in `test/` or `scripts/` never failed anything. One had already slipped through: the fetch mock in `test/client/kosli-client.test.ts` was typed `ReturnType<typeof vi.fn>`, which doesn't match `KosliClient`'s `fetchFn`. That is fixed here. `tsconfig.test.json` and `npm run typecheck` cover the TypeScript in `src`, `test` and `scripts`. `scripts/sync-version.mjs` is plain JS and isn't covered. CI runs the typecheck after the build. ## Stdio smoke test `scripts/smoke.ts` (`npm run smoke`) starts a built server over real stdio and checks three things: - the version it advertises matches `package.json` - it lists exactly the three tools - the tools carry the right safety hints: `execute_write_action` is marked `destructiveHint` and not read-only, and `execute_read_action` and `search_actions` are marked `readOnlyHint`. These hints are what make an MCP client ask before a write, and no other test checks them. - `search_actions` finds `list_environments` A failed tool call reports the server's own error message rather than a JSON parse error. This covers what `test/server.test.ts` can't, because that test runs in memory: whether the bin starts, whether the JSON imports load, and whether a bundle's `node_modules` resolve. The test is offline by default. It does one live read only when `KOSLI_API_TOKEN` and `KOSLI_SMOKE_ORG` are both set, and CI never sets them, so it's fork-safe. CI now runs: 1. build 2. **typecheck** 3. test 4. **smoke `dist/`** 5. pack 6. **unzip the `.mcpb`, run `mcpb validate` on its manifest, and smoke-test it** 7. **on the leg that sets `consumer-floor` in the matrix: switch to exactly Node 22.0.0 and smoke-test the bundle again** There's also a **negative check**: the smoke test must fail against a missing entry point. That way a later refactor can't turn the smoke steps into checks that always pass. Some notes on those steps: - Validating the bundled manifest, not the repo's copy, matters: the repo's `manifest.json` holds a placeholder version, and the real one is only injected at pack time. - The 22.0.0 step exists because the matrix floor is the *dev* floor (vitest needs a newer 22.x, see #47), so nothing tested the version users are promised. The smoke test doesn't need vitest, so it can run there. I rehearsed it locally on the real 22.0.0 binary: it fails on the old bundle and passes on the fixed one. - `@anthropic-ai/mcpb` is now a devDependency rather than an `npx` pin, so Dependabot keeps it up to date. It adds 49 dev-only packages. None of them ship (`files: ["dist"]`), and the server's own `zod` is unchanged at 4.3.6. ## Release workflow: publish only after every check `release.yml` used to run only build and test, then `npm publish`, and only then build the bundle. So a failed pack could leave a version on npm with no GitHub Release. It now runs the same checks as CI: 1. build, typecheck, test 2. smoke `dist/` 3. pack, `mcpb validate`, smoke the bundle 4. only then `npm publish` and the GitHub Release `npm publish` can't be undone, so it stays last. This also checks the bundle under the `npm@latest` that the release job installs, which CI never uses. Both jobs now have a `timeout-minutes` (15 for CI, 20 for release) instead of the 6-hour default. ## Dependabot grouping and cooldown - **Actions:** all SHA bumps go in one group. They edit the same lines, so as separate PRs they conflict (#80 and #82 do today). - **npm dev dependencies:** minor and patch bumps are grouped. - **`@modelcontextprotocol/sdk`:** its minor and patch bumps get their own group, because it's the only runtime dependency. - **Majors** stay one PR each. - **Cooldown:** new releases wait 7 days before being proposed. Security updates aren't affected. ## Docs `CONTRIBUTING.md` gets a "Testing locally" section covering typecheck, smoke (offline and live), MCP Inspector, Claude Code against a checkout, and installing the `.mcpb`. `README.md` and `CLAUDE.md` are updated to match. ## Verification On Node 24 locally: - `build`, `typecheck` and `npm test` (110 tests) pass. - The smoke test passes against `dist/` and against the unzipped bundle. - The smoke test exits 1 when the server fails to start. - `mcpb validate` passes on the bundled manifest, which carries version `0.5.0`. - The live-API smoke test passed against a real org (with SDK 1.30.1). - The bundle smoke test passes on Node 22.0.0, 22.6.0 and 22.7.0. Not run locally: the Node 22 matrix leg, which CI covers. Not run: `release.yml` itself, which only runs on a tag. Its new steps are the same commands CI runs. After merge, check the next Dependabot run is still green. `cooldown` support varies by ecosystem, and an unsupported key invalidates the whole config, not just that block. ## Merge order for the open PRs Suggested order once this lands: #47, then this PR, then #80 → #82 → #83 → #74 → #79 → #84 → #45. Before #79 (SDK), rerun the live smoke test on its branch. #47 conflicts with this PR on the matrix line: when resolving, change the `include:` entry to `node-version: '22.12'` as well. Merge #45 (TypeScript 7) last, after diffing `dist/` output against 5.9.
Contributor
|
@dependabot rebase |
Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v7.0.2) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/typescript-7.0.2
branch
from
October 23, 2026 10:05
b071cdb to
29d89ff
Compare
dangrondahl
approved these changes
Oct 23, 2026
5 tasks
dangrondahl
added a commit
that referenced
this pull request
Oct 23, 2026
Release prep for **0.6.0**. A draft for now: it gets rebased once #97 (CodeQL) merges, then marked ready. `npm version minor --no-git-tag-version` moves `package.json`, `package-lock.json` and the generated `src/version.ts` together. `manifest.json` gets the version at pack time. Nothing else changes. ## What's in 0.6.0 (since 0.5.0) ###⚠️ Changes that affect existing setups - **No configured org (#65).** `KOSLI_ORG` and the Desktop extension's *Organization* setting are removed. Every org-scoped call names its org through the execute tools' `org` input, so no request lands in an org the caller didn't name. An existing config that still sets `KOSLI_ORG` starts fine and logs that the value is ignored, but calls that relied on the default are now refused until an org is given. - **Node ≥ 22 (#38).** It was ≥ 20. ### Fixes - **Evidence downloads work again (#88, fixes #86).** Since 16 Oct, every `get_attestation_evidence` call failed: our token was forwarded to the pre-signed S3 URL. Text files come back as text, and binary files return a clear error. - **The `.mcpb` bundle starts on Node 22.0 – 22.6 (#87).** It didn't before. - **No known vulnerabilities in the bundled dependencies (#96).** `npm audit --omit=dev` is clean. ### Features - **`org` input on the execute tools (#65).** - **`User-Agent` carries the version (#41):** `kosli-mcp-server/<version>`. ### Dependencies - **Runtime:** `@modelcontextprotocol/sdk` 1.29.0 → 1.32.1 (#29, #71, #79). - **Dev:** TypeScript 7 (#45), with emitted output byte-identical to 5.9. vitest 5 (#93). - **Catalog:** regenerated from the OpenAPI spec (#50, #53, #60, #69, #78). ### Release confidence (CI only) Typecheck of tests and scripts, a stdio smoke test against `dist/` and the unzipped bundle (including Node 22.0.0), `mcpb validate`, and `release.yml` publishing only after every check (#87). There's also a phased Claude review (#90), Dependabot grouping with a 7-day cooldown, and CodeQL (#97). ## Checked locally on this branch - Build, typecheck, 122 tests. - The smoke test reports `server advertises version 0.6.0`, both from `dist/` and from the unzipped bundle. - `kosli-mcp-server-0.6.0.mcpb`: the manifest says 0.6.0 and `mcpb validate` passes. ## Before tagging (after merge) - [ ] Rebase onto `main` once #97 merges, then mark ready. - [ ] Install the 0.6.0 `.mcpb` in Claude Desktop, including an upgrade over 0.5.0 with an org configured. - [ ] Run `KOSLI_API_TOKEN=… KOSLI_SMOKE_ORG=<org> npm run smoke` on `main`. - [ ] Download one piece of evidence via `get_attestation_evidence`. - [ ] `git tag -a v0.6.0 -m "v0.6.0" <merge commit> && git push origin v0.6.0`. `release.yml` does the rest.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps typescript from 5.9.3 to 7.0.2.
Release notes
Sourced from typescript's releases.
Commits
1e4744dMerge branch 'main' into ts7-releasea5a219cmicrosoft/typescript-go#4558ecfe30dUpdate status localization5de25b5Hide executable name in TypeScript statusd7ce74aShow bundled TypeScript version for packaged servers29be66aCorrect TS 7 release version to 7.0.2ed2bd1bMerge branch 'main' into ts7-release8873075Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...9427131Set up stable / nightly extension split, other prep (microsoft/typescript-go#...d4eaca5microsoft/typescript-go#4549Maintainer changes
This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.