chore: upgrade typescript to 7.0.2 by matheus1lva · Pull Request #452 · yearn/kong

matheus1lva · 2026-08-01T20:27:08Z

Summary

Moves the entire repo to typescript 7.0.2 (the native Go compiler) — every package, one version, no 5.x anywhere. TS7 ships no JS compiler API, so every tool that consumed the old API had to change: ts-node is replaced with tsx, @typescript-eslint (no TS7-compatible release, peer caps at <6.1.0) is replaced with @babel/eslint-parser, and web moves to next 16 whose Turbopack build and experimental.useTypeScriptCli typecheck work against the native compiler.

How to review

package.json changes: typescript 7.0.2 in ingest/lib/terminal/web (scripts as peer); babel lint deps and eslint-plugin-react now declared at root where the shared flat config imports them.
eslint.config.mjs: parser swapped to @babel/eslint-parser + preset-typescript/react. Core and react rules are unchanged; no-undef/no-redeclare off for TS files (the compiler owns those, matching what @typescript-eslint/recommended did); no-unused-vars in TS files skips PascalCase names since babel can't see type-position usage. The ~36 stale eslint-disable @typescript-eslint/no-explicit-any comments are stripped — the rule no longer exists.
ts-node → tsx in ingest/terminal dev+production scripts, docker/ingest.Dockerfile CMD, and packages/lib/helpers/containers.ts runScript.
web: next 15 → 16.2.12, experimental.useTypeScriptCli enabled (typecheck via native tsc), tsconfig target es5 → ES2017 (es5 removed in TS7), vitest specs excluded from next's typecheck, lint script next lint → eslint . (next lint was removed in 16 and crashed on TS7 anyway), unused eslint-config-next dropped.
NodeJS.Timer → ReturnType<typeof setInterval> in lib: TS7 drops the overload accepting NodeJS.Timer.

Test plan

Automated: bun --filter <pkg> lint passes for ingest, lib, terminal, web (the CI gate) — 0 errors, warning count on par with before
Automated: tsc --noEmit (tsc 7.0.2) clean for ingest and terminal (lib's tsc failures predate this PR — spec files lack test-runner types under 5.7.3 too)
Manual: ingest and terminal boot under tsx (dynamic .ts requires, workers come up; fails only at redis, which wasn't running locally)
Manual: next build passes end to end — Turbopack compile + native-tsc typecheck
Manual: container tests / make dev with docker (not run here)

Risk / impact

Lint semantics shift: babel-based parsing loses TS-aware rules (no-explicit-any warnings are gone) and no-unused-vars can't see type-position usage, hence the PascalCase ignore heuristic.
tsx is transpile-only (ts-node's dev-time type checking is gone; production already ran --transpile-only). Type checking is tsc --noEmit with the native tsc.
next 15 → 16 is a major bump (Turbopack becomes the default bundler); the app builds and prerenders, but a smoke pass of the deployed web app is worth doing.
Rollback: revert the two commits.

- typescript 7.0.2 in ingest, lib, terminal, scripts (peer); web stays 5.7.3 because next 15 requires the TS JS API that v7 (native compiler) no longer ships - root keeps a typescript 5.7.3 devDep so hoisted tooling (typescript-eslint, which has no TS7-compatible release) still resolves a working JS API - swap ts-node -> tsx (ts-node cannot load TS7): dev/production scripts, lib containers runScript, ingest Dockerfile CMD - web lint: next lint -> eslint . (next's TS preflight crashes on TS7), ignore generated/CJS config files, autofix tailwind.config.ts semicolons - fix NodeJS.Timer -> ReturnType<typeof setInterval> (removed overload in TS7)

vercel · 2026-08-01T20:27:15Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
kong	Ready	Preview	Aug 2, 2026 10:33pm

socket-security · 2026-08-01T20:28:33Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
npm/next@13.4.19 ⏵ 16.2.12	⁺²	⁺⁷⁵	^-3	⁺⁴⁹
npm/@babel/preset-react@8.0.1
npm/@babel/preset-typescript@8.0.1
npm/@babel/eslint-parser@8.0.1
npm/@babel/core@7.26.7 ⏵ 8.0.1	⁺¹	⁺¹		^-3
npm/tsx@4.23.1
npm/eslint-plugin-react@7.33.2 ⏵ 7.37.5	^-10
npm/typescript@5.2.2 ⏵ 7.0.2			^-1	⁺¹	⁺¹⁰

View full report

- drop root typescript 5.7.3 shim; typescript resolves to 7.0.2 everywhere - replace @typescript-eslint (requires the removed TS JS API, no TS7-compatible release) with @babel/eslint-parser + preset-typescript/react; same core and react rules, no-unused-vars scoped to skip PascalCase type imports - strip eslint-disable comments referencing the removed no-explicit-any rule - web: next 15 -> 16 (Turbopack parses tsconfig itself) with experimental.useTypeScriptCli so typechecking runs through the native tsc; tsconfig target es5 -> ES2017 (es5 removed in TS7), exclude vitest specs from next typecheck, drop unused eslint-config-next

socket-security · 2026-08-02T01:13:12Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `es-abstract` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/eslint-plugin-react@7.37.5` → `npm/es-abstract@1.24.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/es-abstract@1.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `eslint-plugin-react` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → `npm/eslint-plugin-react@7.37.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-react@7.37.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `yargs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/@testcontainers/postgresql@10.18.0` → `npm/@testcontainers/redis@10.18.0` → `npm/yargs@17.7.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/yargs@17.7.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

lint: - no-unused-vars args:'none' for ts — core rule can't see constructor parameter properties through babel, produced 4 false positives - narrow varsIgnorePattern to PascalCase; scope preset-react to jsx/tsx - lint web's next.config.js/postcss.config.js via globals override instead of ignoring them - drop stale @typescript-eslint/ban-ts-comment directive in db deps: - regenerate bun.lock, prunes ts-node - pin hoisted linker (bun 1.3 defaults to isolated, which breaks phantom deps and both Dockerfile CMDs) - declare tsx at root so ../../node_modules/.bin/tsx resolves in the ingest image web: - set turbopack.root, drop stray yarn.lock - tsconfig.vitest.json so specs keep type checking and @/* paths docs: e2e entrypoint is bun --filter ingest test:containers

vercel Bot deployed to Preview August 1, 2026 20:27 View deployment

matheus1lva marked this pull request as draft August 2, 2026 01:06

vercel Bot deployed to Preview August 2, 2026 01:13 View deployment

vercel Bot deployed to Preview August 2, 2026 22:33 View deployment

Navigation Menu

Uh oh!

chore: upgrade typescript to 7.0.2 - #452

chore: upgrade typescript to 7.0.2#452
matheus1lva wants to merge 3 commits into
mainfrom
new-typescript

matheus1lva commented Aug 1, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 1, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 1, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

matheus1lva commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How to review

Test plan

Risk / impact

Uh oh!

vercel Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

matheus1lva commented Aug 1, 2026 •

edited

Loading

vercel Bot commented Aug 1, 2026 •

edited

Loading

socket-security Bot commented Aug 1, 2026 •

edited

Loading

socket-security Bot commented Aug 2, 2026 •

edited

Loading