TypeScript 7 migration: the CJS dual build uses moduleResolution=node10, removed in TS 7

[dean0x]

Symptom

Dependabot PR #169 (typescript 6.0.3 → 7.0.2) has been red since 2026-08-09 (run 31298533437). All three JS packages — build & test legs (ubuntu, macos, windows) fail with:

tsconfig.cjs.json(5,25): error TS5108: Option 'moduleResolution=node10' has been removed. Please remove it from your configuration.

(The same run also shows a stale-base rustfmt failure, which is unrelated base drift.)

Affected files

• packages/bundler-utils/tsconfig.cjs.json
• packages/webpack-loader/tsconfig.cjs.json
• packages/rspack-loader/tsconfig.cjs.json

Each is "module": "CommonJS" + "moduleResolution": "Node10" + "ignoreDeprecations": "6.0", extending tsconfig.base.json (module: Node16 / moduleResolution: Node16).

Build script (each package): tsc -p tsconfig.json && tsc -p tsconfig.cjs.json && node ../../scripts/write-cjs-package.cjs dist-cjs.

dist-cjs/ is load-bearing: it backs main and exports["."].require, and is listed in files.

Root cause

The failure is structural, not base drift — a rebase cannot fix it. The three packages are "type": "module", so a second Node16 pass cannot emit CommonJS; the Node10 resolver was the escape hatch that let the CJS pass run, and TypeScript 7 removed it (TS5108). The ignoreDeprecations: "6.0" waiver expires with it.

Options

• (a) Drop the CJS half for the three packages. Zero external users; the repo's clean-break-forward precedent applies. Caveat: webpack and rspack resolve loaders via require() — verify ESM-loader support in the versions we target before choosing this.
• (b) Keep dual output under a module / moduleResolution pairing that TS 7 accepts (read the TS 7 release notes, not memory). Cheapest spike: npx -p typescript@7.0.2 tsc -p tsconfig.cjs.json with the moduleResolution and ignoreDeprecations options deleted. Alternative: post-process with a bundler (a new build surface).
• (c) Stay on 6.0.3 — dead end; the 6.x line is frozen at 6.0.3 (2026-04-16).

Notes

• Six workspace packages pin "typescript": "^6.0.3".
• engines.node >= 16.20.0; CI uses Node 22.
• 7.0.2 (2026-07-08) is the first stable 7.x (no stable 7.0.0/7.0.1). TS 7 ships as a shim package plus 20 @typescript/typescript-<platform> optionalDependencies. The npm releaser identity is now microsoft1es (Microsoft 1ES) — verify at adoption time.
• Until this lands, .github/dependabot.yml ignores typescript semver-major version updates (version updates only; security updates still arrive). Remove that entry when this closes.
• Replaces Dependabot PR chore(deps): bump typescript from 6.0.3 to 7.0.2 #169.