mono - chore: upgrade TypeScript and build tooling (breaking)

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage. — n/a, dependency bump with no source changes; the existing suites are the coverage.

What kind of change does this PR introduce?

Chore — dependency upgrade. Second PR in the dev phase, covering the TypeScript and build toolchain. Follows #2021.

Summary

Upgrades the TypeScript/build toolchain to the versions surfaced by pnpm outdated, including a TypeScript major (6 → 7). No source or tsconfig changes were needed — everything builds and tests clean on 7.0.2.

Changes

• typescript 6.0.3 → 7.0.2 (major) — root, @keyv/serialize-msgpackr, @keyv/serialize-superjson
• tsx 4.22.4 → 4.23.1 — root, @keyv/bigmap, @keyv/website
• tsdown 0.22.3 → 0.22.14 — root
• js-yaml 5.2.0 → 5.2.2 — root
• docula 2.1.0 → 2.2.0 — @keyv/website

All targets are the exact Latest values from pnpm outdated, so the workspace minimumReleaseAge gate (4 days) is respected.

Deliberately held back: @types/node

pnpm outdated offers @types/node 24.13.1 → 26.1.2, and this PR does not take it. pnpm-workspace.yaml pins overrides: "@types/node": ^24.13.1 with a comment tying it to the Node major in .nvmrc (24), so 26.x is out of range by design until the repo moves to Node 26.

Worth a separate decision at some point: the tests.yaml matrix already runs Node 22, 24, and 26, so the types are a major behind the newest runtime being exercised. That's a repo-policy call, not a dependency bump, so I've left it alone.

Verification

• pnpm build — all 20 packages build clean on TypeScript 7.0.2 (tsc --version → 7.0.2)
• pnpm test for the 12 packages that don't need Docker services — 894 tests passed, 4 todo
• pnpm test:scripts — 20 tests passed (exercises the bumped js-yaml)
• pnpm generate-docs — the tsx 4.23.1 path runs clean, all adapters processed
• Docker-backed adapter suites — not run locally (no Docker in this sandbox); CI covers those
• pnpm website:build — cannot complete in this sandbox: docula build calls the GitHub releases API and gets HTTP 401 without credentials. I verified this is pre-existing and not a docula regression by re-running the same build on the previous version — docula 2.1.0 fails with the identical 401. This job only runs on release/workflow_dispatch, not on PR CI.

Breaking notes

typescript crosses a major (6 → 7). Nothing in this repo needed changing — no tsconfig migration, no source edits, no new diagnostics — but consumers building against these packages from source should be aware the pinned compiler moved a major. Published output is unaffected: tsdown emits the same CJS/ESM/.d.ts shapes.

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	docula@​2.2.0
	tsx@​4.23.1
	tsdown@​0.22.14
	typescript@​7.0.2
	js-yaml@​5.2.2

View full report

[gemini-code-assist]

Code Review

This pull request updates several dependencies across the workspace, including tsx, js-yaml, tsdown, docula, and typescript. A critical security vulnerability was identified regarding the update of typescript to version 7.0.2 (and previously 6.0.3). These versions do not exist in official Microsoft releases and pull unofficial, platform-specific packages, indicating a potential supply chain attack. It is highly recommended to revert these changes and use a verified, official version of TypeScript.

[gemini-code-assist]

🚨 CRITICAL SECURITY WARNING: Potential Supply Chain Attack / Malicious Dependency\n\nThe package typescript at version 7.0.2 (and previously 6.0.3) does not exist in the official Microsoft TypeScript releases. Please revert this change immediately and use an official, verified version of TypeScript (e.g., ^5.7.3).

Suggested change

	"typescript": "^7.0.2",
	"typescript": "^5.7.3",

[jaredwray]

Not applying — same as the root package.json thread. Don't click "Commit suggestion": main already ships typescript@6.0.3, so ^5.7.3 downgrades two majors.

7.0.2 is the official latest on npm under the Microsoft maintainer set. Evidence: here.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (57bdd0d) to head (c6dc845).

Additional details and impacted files

@@             Coverage Diff             @@
##             main     #2022      +/-   ##
===========================================
+ Coverage   99.96%   100.00%   +0.03%     
===========================================
  Files          55        55              
  Lines        5067      5067              
  Branches      825       819       -6     
===========================================
+ Hits         5065      5067       +2     
+ Misses          2         0       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jaredwray]

Re: @gemini-code-assist's "supply chain attack" finding on typescript@7.0.2 — not applying it

I took this seriously and verified it against the registry before responding. The finding is incorrect on all three of its factual claims, and its suggested fix would make things worse. I have not pushed the suggested change; leaving the threads open for @jaredwray to make the call.

Claim 1 — "typescript@7.0.2 does not exist in official Microsoft releases; the official compiler is at 5.x."

It is the current latest tag on the official registry:

$ npm view typescript@7.0.2 name version dist.tarball
name    = 'typescript'
version = '7.0.2'
tarball = 'https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz'

$ npm view typescript dist-tags
{ beta: '6.0.0-beta', rc: '7.0.1-rc', latest: '7.0.2', next: '7.1.0-dev.20260802.1', ... }

That's the plain typescript name on registry.npmjs.org — not a lookalike, not a fork. repository is git+https://github.com/microsoft/TypeScript.git.

Claim 2 — "@typescript/* is not an official Microsoft scope."

Those packages are declared as optionalDependencies by typescript@7.0.2 itself, and they carry a maintainer list identical to typescript's:

microsoft1es <npmjs@microsoft.com>
typescript-bot <typescript@microsoft.com>
typescript-deploys <typescript-design@microsoft.com>
microsoft-oss-releases <microsoft-oss-publishing@microsoft.com>
weswigham, andrewbranch, jakebailey

Platform-specific binaries are the defining characteristic of TypeScript 7 — it's the native (Go) port of the compiler. "Official TypeScript is a pure JavaScript package" was true through 5.x and is exactly the assumption that no longer holds. The presence of native artifacts here is the expected shape of the release, not an anomaly.

Claim 3 — the implied baseline. The review says "and previously 6.0.3", then recommends ^5.7.3. main was already on typescript@6.0.3 before this PR; this PR moves 6 → 7. Applying the suggestion would downgrade the repo by two majors, breaking the build rather than restoring a safe state. That's the part worth flagging most: the three inline suggestion blocks are click-to-apply, and clicking any of them lands a two-major downgrade.

Corroboration: all 14 checks on this PR are green, including three independent security scanners — CodeQL, Aikido, and Socket Security — none of which flagged typescript@7.0.2 or the @typescript/* packages. Socket in particular scores it 99 supply-chain / 100 vulnerability / 100 license.

My read is that this is a stale-training-data artifact: the reviewer's model predates TypeScript 6 and 7 and is reasoning from a world where 5.x was current. No action needed, but I'd rather leave that judgement to you than silently resolve a "critical security" thread.

---

Generated by Claude Code