Forge uses older typescript version

[alexanderpaolini]

Right now forge specifies the typescript version as ^5.6.3. As per nom, typescript is at 5.9.3. Updating typescript and solving any issues it causes before this next upcoming sprint is probably a good idea.

[coderabbitai]

Warning

A plan generation is already in progress. Please wait for it to complete before requesting a new plan.

[coderabbitai]

Warning

A plan generation is already in progress. Please wait for it to complete before requesting a new plan.

[coderabbitai]

Coding Plan

Summary

• Update the centralized TypeScript version in pnpm-workspace.yaml catalog from ^5.6.3 to ^5.9.3, which propagates to all 17 packages using the catalog reference
• Migrate apps/2025 from its pinned ~5.7.2 version to use the catalog for consistency
• Proactively update @types/node to latest 22.x to address TypeScript 5.9's Buffer/ArrayBuffer type relationship changes
• Fix type errors in files with Buffer operations (primarily in packages/api and apps/cron) by adjusting type annotations or using appropriate conversion patterns

Design Choices

Design Choice 1: Should apps/2025 continue using a pinned TypeScript version or migrate to the catalog?

Options Considered:

1. Keep apps/2025 pinned at ~5.7.2 for safety
2. Migrate apps/2025 to use the catalog for consistency

Chosen Option: 2

Rationale: Migrate to catalog to maintain consistency across the monorepo and reduce maintenance burden; re-pin only if specific incompatibilities emerge during testing.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Update TypeScript Version and Dependencies

This phase updates the central TypeScript version in the PNPM catalog and ensures all dependent tooling remains compatible. The key change is updating from ^5.6.3 to ^5.9.3, which spans three minor versions with cumulative breaking changes.

Task 1: Update PNPM Catalog TypeScript Version

Update the centralized TypeScript version that all packages reference via the catalog feature.

• Modify pnpm-workspace.yaml to change the catalog entry from typescript: ^5.6.3 to typescript: ^5.9.3
• This single change will propagate to all 17 packages using "typescript": "catalog:"

Task 2: Align apps/2025 with Catalog

Remove the pinned TypeScript version in apps/2025 to consolidate version management.

• Modify apps/2025/package.json to change "typescript": "~5.7.2" to "typescript": "catalog:"
• This ensures all apps use the same TypeScript version for consistent behavior

Task 3: Update `@types/node` for Buffer Compatibility

TypeScript 5.9 changes the ArrayBuffer/TypedArray type relationships, and the official guidance is to update @types/node to resolve Buffer-related type errors.

• Update the @types/node override in root package.json from ^22.10.1 to the latest 22.x version
• This proactively addresses potential Buffer type incompatibilities before they manifest as errors

Task 4: Regenerate Lockfile

Apply all version changes and resolve the dependency graph.

• Run pnpm install to update pnpm-lock.yaml with the new TypeScript and @types/node versions
• Verify the resolved TypeScript version is 5.9.3 or compatible

🤖 Prompt for AI agents

Update TypeScript from ^5.6.3 to ^5.9.3 in the PNPM catalog and align all
packages to use this version consistently.

**Update centralized TypeScript version:**
- In `pnpm-workspace.yaml`, change the catalog entry from `typescript: ^5.6.3`
to `typescript: ^5.9.3`

**Migrate apps/2025 to use catalog:**
- In `apps/2025/package.json`, change `"typescript": "~5.7.2"` to `"typescript":
"catalog:"`

**Update `@types/node` for Buffer compatibility:**
- In root `package.json`, update the `@types/node` override from `^22.10.1` to
the latest 22.x version

**Regenerate lockfile:**
- Run `pnpm install` to update `pnpm-lock.yaml` with the new versions
- Verify the resolved TypeScript version is 5.9.3 or compatible

Phase 2: Address Buffer and ArrayBuffer Type Compatibility

TypeScript 5.9's breaking change makes ArrayBuffer no longer a supertype of TypedArrays (including Node's Buffer). This phase addresses type errors in files that perform Buffer operations, particularly base64 encoding/decoding, cryptographic operations, and file handling.

Task 1: Fix Buffer Type Annotations in Cryptographic Operations

The judge router uses Buffer for HMAC signature verification with crypto.timingSafeEqual(), which may need type adjustments.

• Review packages/api/src/routers/judge.ts for Buffer type annotations on the b64url helper function (line 32-35)
• Ensure crypto.timingSafeEqual() calls (line 93-95) receive properly typed Buffer arguments
• If type errors occur, use explicit Buffer type assertions or adjust function signatures to align with updated type definitions

Task 2: Fix ArrayBuffer to Buffer Conversion

The animals cron job converts ArrayBuffer from fetch responses to Buffer for Sharp image processing, which is directly affected by the TypeScript 5.9 ArrayBuffer changes.

• Review apps/cron/src/crons/animals.ts around line 119-121 where response.arrayBuffer() result is converted via Buffer.from(buffer)
• If type errors occur, use Buffer.from(new Uint8Array(arrayBuffer)) pattern instead of direct ArrayBuffer conversion
• Alternatively, use explicit type assertions if the runtime behavior is correct

Task 3: Fix Base64 File Upload Handlers

Multiple routers decode base64 data to Buffer for file uploads to MinIO/S3, which may surface type errors.

• Review packages/api/src/routers/guild.ts for profile picture base64 decoding
• Review packages/api/src/routers/resume.ts for resume file base64 decoding
• Review packages/api/src/routers/passkit.ts for certificate/key base64 decoding (multiple Buffer.from calls)
• Review packages/api/src/utils.ts for Google private key decoding
• Address any type errors by ensuring Buffer.from() calls have properly typed inputs

Task 4: Fix QRCode Buffer Return Types

QRCode.toBuffer() returns Buffer objects that are passed to MinIO, which may need type adjustments.

• Review packages/api/src/routers/qr.ts, packages/api/src/routers/member.ts, and packages/api/src/routers/hacker.ts for QRCode.toBuffer() usage
• Verify @types/qrcode return types are compatible with MinIO client expectations
• Add type assertions if needed to satisfy MinIO putObject() parameter types

Task 5: Address Additional Type Errors

TypeScript 5.7+ introduces stronger "never initialized" variable checking and type inference changes that may surface new errors across the codebase.

• Run pnpm tsc --noEmit across the monorepo to identify all type errors
• Fix any "variable used before being assigned" errors by ensuring proper initialization
• Fix any type argument inference errors by adding explicit type parameters where needed
• Address any other errors surfaced by the stricter type checking in 5.7-5.9

🤖 Prompt for AI agents

Fix type errors caused by TypeScript 5.9's breaking change where ArrayBuffer is
no longer a supertype of TypedArrays/Buffer. Focus on Buffer operations in
cryptographic code, file uploads, and image processing.

**Fix cryptographic operations:**
- In `packages/api/src/routers/judge.ts`, review the `b64url` helper function
(line 32-35) and `crypto.timingSafeEqual()` calls (line 93-95)
- Add explicit `Buffer` type assertions or adjust function signatures if type
errors occur

**Fix ArrayBuffer to Buffer conversions:**
- In `apps/cron/src/crons/animals.ts` around line 119-121, review the
`Buffer.from(buffer)` call that converts `response.arrayBuffer()` results
- If type errors occur, use the pattern `Buffer.from(new
Uint8Array(arrayBuffer))` instead of direct ArrayBuffer conversion

**Fix base64 file upload handlers:**
- Review and fix Buffer.from() calls in:
  - `packages/api/src/routers/guild.ts` (profile picture base64 decoding)
  - `packages/api/src/routers/resume.ts` (resume file base64 decoding)
- `packages/api/src/routers/passkit.ts` (certificate/key base64 decoding,
multiple calls)
  - `packages/api/src/utils.ts` (Google private key decoding)
- Ensure Buffer.from() calls have properly typed inputs

**Fix QRCode buffer return types:**
- Review QRCode.toBuffer() usage in `packages/api/src/routers/qr.ts`,
`packages/api/src/routers/member.ts`, and `packages/api/src/routers/hacker.ts`
- Add type assertions if needed to satisfy MinIO putObject() parameter types

**Address additional type errors:**
- Run `pnpm tsc --noEmit` to identify all type errors
- Fix "variable used before being assigned" errors by ensuring proper
initialization
- Add explicit type parameters where type inference fails
- Address any other errors from stricter type checking in TypeScript 5.7-5.9

Research

This is a PNPM monorepo using the catalog feature to centralize TypeScript version management in pnpm-workspace.yaml. The catalog specifies typescript: ^5.6.3, which 17 packages reference via "typescript": "catalog:". One exception is apps/2025, which pins TypeScript to ~5.7.2 for Tailwind CSS 4.x compatibility. The codebase uses Buffer extensively in packages/api for cryptographic operations, file uploads, QR code generation, and certificate handling, as well as in apps/cron for image processing. All packages are pure ESM with shared TypeScript configurations in tooling/typescript/.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Update TypeScript from ^5.6.3 to ^5.9.3 in the PNPM catalog and align all
packages to use this version consistently.

**Update centralized TypeScript version:**
- In `pnpm-workspace.yaml`, change the catalog entry from `typescript: ^5.6.3`
to `typescript: ^5.9.3`

**Migrate apps/2025 to use catalog:**
- In `apps/2025/package.json`, change `"typescript": "~5.7.2"` to `"typescript":
"catalog:"`

**Update `@types/node` for Buffer compatibility:**
- In root `package.json`, update the `@types/node` override from `^22.10.1` to
the latest 22.x version

**Regenerate lockfile:**
- Run `pnpm install` to update `pnpm-lock.yaml` with the new versions
- Verify the resolved TypeScript version is 5.9.3 or compatible
===============================================================================

Task: 2

Fix type errors caused by TypeScript 5.9's breaking change where ArrayBuffer is
no longer a supertype of TypedArrays/Buffer. Focus on Buffer operations in
cryptographic code, file uploads, and image processing.

**Fix cryptographic operations:**
- In `packages/api/src/routers/judge.ts`, review the `b64url` helper function
(line 32-35) and `crypto.timingSafeEqual()` calls (line 93-95)
- Add explicit `Buffer` type assertions or adjust function signatures if type
errors occur

**Fix ArrayBuffer to Buffer conversions:**
- In `apps/cron/src/crons/animals.ts` around line 119-121, review the
`Buffer.from(buffer)` call that converts `response.arrayBuffer()` results
- If type errors occur, use the pattern `Buffer.from(new
Uint8Array(arrayBuffer))` instead of direct ArrayBuffer conversion

**Fix base64 file upload handlers:**
- Review and fix Buffer.from() calls in:
  - `packages/api/src/routers/guild.ts` (profile picture base64 decoding)
  - `packages/api/src/routers/resume.ts` (resume file base64 decoding)
- `packages/api/src/routers/passkit.ts` (certificate/key base64 decoding,
multiple calls)
  - `packages/api/src/utils.ts` (Google private key decoding)
- Ensure Buffer.from() calls have properly typed inputs

**Fix QRCode buffer return types:**
- Review QRCode.toBuffer() usage in `packages/api/src/routers/qr.ts`,
`packages/api/src/routers/member.ts`, and `packages/api/src/routers/hacker.ts`
- Add type assertions if needed to satisfy MinIO putObject() parameter types

**Address additional type errors:**
- Run `pnpm tsc --noEmit` to identify all type errors
- Fix "variable used before being assigned" errors by ensuring proper
initialization
- Add explicit type parameters where type inference fails
- Address any other errors from stricter type checking in TypeScript 5.7-5.9

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!