v3.0.0 — dated readiness ledger, TS6 API shim, alias layouts

The name list becomes a dated readiness ledger, and the officially documented TS6 API shim becomes first-class.

Flagging a CONFLICT on package name alone was correct on GA day (2026-07-08) and gets more wrong every week — typescript-eslint v8.65.0 (2026-07-20) already ships a "TS 7 detected" warning — while a repo that adopted the announcement's documented @typescript/typescript6 escape hatch still got a wall of CONFLICTs (or, in the alias layout, was misread as plain TypeScript 6).

Added

• Readiness ledger: db entries gain optional ts7Ready (semver range), ts7Status ("none" | "partial" | "supported"), source (URL) and checkedAt (ISO date); the db gains a top-level generatedAt. For each covered dependency the guard resolves the effective version — the installed node_modules/<pkg>/package.json version when present (per package dir, falling back to the repo root in monorepos), else the minimum of the declared range. Satisfies ts7Ready → new NOTICE severity (never fails); ts7Status: "partial" → warning with the source URL; no ts7Ready → the classic conflict, unchanged. Prereleases compare with includePrerelease; malformed installed manifests fall back to the declared range.
• TS6 API shim detection (@typescript/typescript6), both documented layouts: a plain dependency, and any npm:@typescript/typescript6@… alias — including the typescript key itself. When present: a "TS6 API shim present" advisory, and every Compiler-API dependency conflict is downgraded to a warning (removed-tsconfig-option conflicts are not downgraded — the shim restores the API, not the config options).
• Alias-target resolution: "@typescript/native": "npm:typescript@^7.0.2" (any key name) now reports TypeScript 7.0 as installed, and "typescript": "npm:@typescript/typescript6@^6.0.2" reports the TS6 API half explicitly. v2 stripped alias targets and misread the announcement's exact side-by-side layout as plain TypeScript 6.
• db --check subcommand (opt-in network; never runs during a scan or in the Action): fetches each db package's npm registry document, walks the versions map, and finds the earliest stable release whose bounded typescript peer range widens to admit 7.x; prints a proposed db.json patch + diff and writes nothing. Unbounded ranges (*, >=2.7, …) are never proposed as supported — measured 2026-07-29, 7 of the 25 covered packages carry unbounded ranges while being known-broken. 404/network/missing-peer cases report unknown instead of crashing.
• Stale-db notice: when the bundled ledger's generatedAt is older than 60 days, scans print a non-failing refresh suggestion.
• Action outputs notice-count and shim-detected; status gains a notice value; NOTICE annotations for TS7-ready deps; SARIF carries notices as level: note under ts7-compat/ready/<pkg>.
• Seeded readiness data for all 25 packages — truthfully all ts7Status: "none" as of 2026-07-29 (verified against the registry: not one ships a bounded peer range admitting 7.x), each with a real source URL and checkedAt. No invented version numbers.
• 37 new tests (151 total).

Changed

• BREAKING (exit codes): repos whose flagged dependencies satisfy ts7Ready, or which have the TS6 shim installed, now exit 0 where v2 exited 1. Removed tsconfig options on TS7 still exit 1.
• BREAKING (db shape): src/db.json is now { generatedAt, packages: { … } }. The ts7-compat-guard module still exports the flat map as db / builtinDb; --db / .ts7guardrc.json extra entries stay flat and may carry the new fields.
• JSON report: per-entry severity (a shim downgrade or partial status can differ from the run-level ts7 flag), plus notices, noticeCount, shim, dbStale, and effectiveVersion fields.

Upgrade

- uses: Booyaka101/ts7-compat-guard@v3

npx ts7-compat-guard          # scan (offline)
npx ts7-compat-guard db --check   # propose readiness-db updates (network, writes nothing)

v2.2.1 — bundle decoupled from package.json

No rule changes; a build-integrity fix.

The action bundle inlined the entire package.json (esbuild does that when source does require('../package.json')), so unrelated manifest edits — a new script, an allowScripts entry — changed dist/action.js and reddened the bundle-drift job three times in one day.

The version is now injected via esbuild's define, making the bundle a pure function of the source. Verified by adding a throwaway package.json field, rebuilding, and confirming dist came out byte-identical.

src/ ships to npm where that define does not exist, so safeVersion() falls back to a runtime readFileSync — which esbuild cannot inline, keeping the bundle decoupled while making the unbundled path report the real version instead of 0.0.0. That path is not reachable today (src/action.js is neither bin nor main), but it ships and should not be a trap.

114 tests pass.

v2.2.0 — two blockers found by actually running the upgrade

Both rules in this release came from upgrading our own repos to TypeScript 7 and watching what broke — not from reading release notes. The tool reported all three repos clean beforehand.

• tsup is now flagged. Its declaration emit goes through the TypeScript Compiler API and crashes on 7.0 with Cannot read properties of undefined (reading useCaseSensitiveFileNames) — the same class of blocker already recorded for ts-morph. A project can typecheck perfectly under 7.0 and still fail to build.
• A missing tsconfig types field is now an advisory. TypeScript 7 does not reliably auto-include node_modules/@types. Three repos with @types/node and no types field failed with TS2591 Cannot find name 'process' and TS2584 Cannot find name 'console'; adding "types": ["node"] fixed all three. It is a no-op on 5/6 — it pins what was already inferred.

114 tests pass.

v2.0.1 — Marketplace listing

Metadata-only release so the Action can be listed on the GitHub Marketplace.

Changed

• action.yml: description shortened to 121 characters (Marketplace rejects 125+), author aligned with package.json.

No behavioural change — inputs, outputs, detection database and dist/action.js logic are identical to v2.0.0.

- uses: Booyaka101/ts7-compat-guard@v2

See CHANGELOG.md for the full v2.0.0 feature list.

v2.0.0 — tsgo readiness

TypeScript 7.0 / tsgo readiness scanner. v2 grows from a package.json-only Compiler-API linter into a full readiness gate — while keeping the manifest/config-only, no source scanning, no false positives promise.

Three pillars

• Compiler-API dependencies (package.json) — 24 curated packages.
• Removed tsconfig options (tsconfig.json) — 17 options + references.prepend, each reported with its exact line/column. JSONC-aware, follows relative extends. conflict on TS7, warning on TS6.
• Behavioural advisories (never fail the build) — strict default-on, emitDecoratorMetadata (parity unresolved upstream, with NestJS/TypeORM/etc dependency context), ignoreDeprecations.

Also new

• --no-tsconfig; Action outputs tsconfig-count / advisory-count; new advisory status; namespaced SARIF rules (dep/tsconfig/risk) with tsconfig file/line annotations.
• 114 tests. Facts verified against the TS7 GA announcement and typescript-go#741.

npx ts7-compat-guard          # CLI
uses: Booyaka101/ts7-compat-guard@v2   # Action

Full details in CHANGELOG.md.

v1.0.0

Initial release. Detect TypeScript 7.0 Compiler API incompatibilities in package.json before they break framework type-checking (Vue/Volar, Astro, Svelte, MDX, Angular, ts-node, ts-morph, typescript-eslint, and more).

• CLI: npx ts7-compat-guard
• GitHub Action: uses: Booyaka101/ts7-compat-guard@v1

See CHANGELOG.md for details.