Skip to content

chore(TD-9488): Phase 1a — TypeScript 3.8→5.5 + test/lint toolchain - #170

Merged
VDubber merged 3 commits into
td-9488/eol-upgradesfrom
td-9488/ts-upgrade
Oct 21, 2026
Merged

VDubber merged 3 commits into
td-9488/eol-upgradesfrom
td-9488/ts-upgrade

Conversation

@VDubber

@VDubber VDubber commented Oct 20, 2026

Copy link
Copy Markdown
Contributor

Stacked on #169. Prerequisite for the Apollo swap — @apollo/client 3 / graphql 16 types won't parse under TS 3.8.

  • typescript 3.8 → 5.5, @types/node 13 → 22
  • jest/ts-jest/@types/jest 27 → 29
  • @typescript-eslint 5 → 8, eslint 8.8 → 8.57 (stay 8.x, no flat-config churn), eslint-plugin-jest 23 → 28, eslint-config-prettier 6 → 9
  • @types/node-fetch 3 → 2.6.11 (correct major)
  • v8 no-explicit-any / no-require-imports / no-unused-vars pinned to warn — keeps this a mechanical bump
  • Cast node-fetch's fetch to the global signature at the BatchHttpLink site (@types/node 22 added a global fetch type apollo-link now prefers; Phase 2 removes this block)

72 tests green, lint 0 errors, build clean. Contract semantically unchanged (baseline regenerated under TS 5 — emission-style only). Total audit 44 → 35 (dev tree).
🤖 Generated with Claude Code

@VDubber
VDubber requested a review from a team as a code owner October 20, 2026 21:47
@socket-security

socket-security Bot commented Oct 20, 2026 •

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
License policy violation: npm typescript

License: LicenseRef-W3C-Community-Final-Specification-Agreement - The applicable license policy does not permit this license (5) (package/ThirdPartyNoticeText.txt)

From: package-lock.json → npm/typescript@5.9.3

ℹ Read more on: This package | This alert | What is a license policy violation?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@5.9.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

Comment thread package.json
Comment thread package.json
Comment thread src/index.ts Outdated
@VDubber
VDubber force-pushed the td-9488/ts-upgrade branch from bd608f5 to e4e3ad0 Compare October 21, 2026 15:01
tom-foley-j1
tom-foley-j1 previously approved these changes Oct 21, 2026
VDubber and others added 3 commits October 21, 2026 11:19
…lchain

Prerequisite for the Apollo/graphql swap (Phase 2): @apollo/client 3 and
graphql 16 types will not parse under TypeScript 3.8. Also clears a chunk of
the dev-tree vulns (jest/babel/jsdom).

- typescript 3.8 -> 5.5, @types/node 13 -> 22
- jest / ts-jest / @types/jest 27 -> 29
- @typescript-eslint/* 5 -> 8, eslint 8.8 -> 8.57 (stay on 8.x — no flat-config
  migration), eslint-plugin-jest 23 -> 28, eslint-config-prettier 6 -> 9
  (drop the removed prettier/@typescript-eslint extend)
- @types/node-fetch 3 -> 2.6.11 (correct major for node-fetch 2)
- Pin the @typescript-eslint v8 rules that changed severity
  (no-explicit-any, no-require-imports, no-unused-vars) to "warn" to keep this
  a mechanical toolchain bump, not a code cleanup.
- eslint-plugin-jest 28 auto-fixed a deprecated matcher in index.new.test.ts
  (toReturnWith -> toHaveReturnedWith).
- Cast node-fetch's fetch to the global fetch signature at the BatchHttpLink
  site: @types/node 22 added a global fetch type that apollo-link-http-common
  now prefers, conflicting with node-fetch 2's type. Phase 2 removes this block.

72 tests green, lint 0 errors, tsc build clean. Public contract semantically
unchanged — baseline .d.ts regenerated under TS 5 (emission-style diffs only).
Total npm audit 44 -> 35.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Takes the test runner to the current major. Clears the braces/micromatch dev
advisory that jest 29's transitive tree pulled. 72 tests green, contract
unchanged (dev-only).

Note: the dev-tree audit does not reach 0 — braces (stack-exhaustion) and
sprintf-js (unbounded precision) advisories have no published fix, and the
remaining micromatch/braces chain is pulled by lint-staged 12 (a config-shape
migration, tracked separately). Production audit remains 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…comment fixes

Follows the TS 5.9 upgrade in this PR, which lifts the type-parse constraints
that previously held these back:

- Bump `pino 8 -> 10` and `nock 11 -> 14` (both were pinned low only because
  their type declarations don't parse under TS 3.8/3.x). v3 no longer ships an
  unmaintained logger major, and the nock test net runs on a supported major.
- Add `--max-warnings 27` to the lint script so the current warning count is a
  ratchet: existing warnings don't block, but any NEW violation fails the gate
  (restores enforcement lost when the v8 rules were set to `warn`).
- Reword the BatchHttpLink fetch-cast comment: the cast is REQUIRED (node-fetch 2
  vs DOM fetch signature), not a Phase-2 leftover. Removing it fails to compile;
  it can only go away in a future native-fetch/ESM migration.
- Correct the Phase 1a summary in DEPENDENCY-AUDIT.md: it's jest 27 -> 30 (two
  majors) and TypeScript 3.8 -> 5.9, not "27 -> 29" / "5.5".

75 tests green under TS 5.9 + nock 14 + pino 10, lint gate passes at 27 warnings,
contract baseline unchanged.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@VDubber
VDubber merged commit d9b8b48 into main Oct 21, 2026
6 checks passed
@VDubber
VDubber deleted the td-9488/ts-upgrade branch October 21, 2026 17:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants