Decline the TypeScript 7 major, narrowly and on purpose - #19
Merged
Conversation
ts-node 10 and ts-jest 29 consume the TypeScript 5 compiler API. typescript 7.0.2 exports only version and versionMajorMinor, so every compiler entry point those tools call is undefined, and ts-jest 29 declares peer typescript ">=4.3 <7", which npm rejects with ERESOLVE. Taking the major means migrating the test transformer and the loader to buy a devDependency change no user can observe. Scope: dependency-name typescript, update-types version-update:semver-major, and no versions range. An ignore.versions entry filters security updates too; a semver-major update-type does not. Patch and minor releases of typescript still open pull requests, so a security fix to the minimum patched version is still surfaced. Verified: js-yaml 4.3.1 and PyYAML 6.0.1 both parse the file, and it validates against the schemastore dependabot-2.0 JSON schema. Signed-off-by: reesebuilt <126643625+reesepj@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ts-node 10 and ts-jest 29 consume the TypeScript 5 compiler API, which TypeScript 7 removes, so the upgrade is toolchain-blocked and carries no user-facing value today. Recording that as a scoped Dependabot ignore rather than leaving the notification to be dismissed repeatedly.
The scope matters and was verified rather than assumed: the rule uses
update-types: [version-update:semver-major], NOT aversionsrange.ignore.versionsfilters security updates too, so a range would suppress a security fix landing in the ignored range;update-typesdoes not. A TypeScript security fix reaching the minimum patched version lands as a 5.9.x patch or 5.x minor and is unaffected.dependency-nameis the exact string, no wildcard: 1 of 11 direct dependencies matched.Validated against the schemastore dependabot schema and by two YAML parsers. Falsifiers: dropping the
version-update:prefix fails schema validation; substituting a versions range or a wildcard name fails the scope check.