From 39a9bbff41d9a97f84952cd171de2cf79d2d307c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Neo=20=E5=AD=AB?= Date: Tue, 4 Aug 2026 19:16:23 +0800 Subject: [PATCH] =?UTF-8?q?chore(iac):=20adopt=20TypeScript=206.0.3=20?= =?UTF-8?q?=E2=80=94=20tested,=20unlike=20the=207.0=20proposal?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot opened TypeScript 6.0.3 (#28) right after the 7.0 investigation. Tested the same way, and it came out differently: 6.0.3 tsc --noEmit exit 0 · 8/8 stack tests · cdk synth 9 stacks -> ADOPTED 7.0.2 tsc --noEmit exit 0, but ALL 8 stack tests die at startup: TypeError: Cannot read properties of undefined (reading 'fileExists') `ts-node` works with TS 6 and not with TS 7, which is the native rewrite that no longer exposes the `ts.sys` JS surface ts-node reads its tsconfig through. So the `>= 7` ignore added in #27 is drawn at the measured break point rather than at "no major upgrades", and this is the upgrade it was always going to allow through. Worth recording: the implicit-`@types` removal — the cause of the 7 x TS2591 "Cannot find name 'process'" errors seen during the 7.0 test — actually landed in **6.0**, not 7. Verified by removing `types: ["node"]` under 6.0.3 and watching them come back. So the one-line tsconfig fix shipped in #27 is precisely what unblocked this upgrade. It was correct on its own terms before either upgrade was attempted, which is the useful shape: making an implicit dependency explicit paid off one major earlier than expected. Also documented in this branch, with evidence, a HIGH Dependabot alert that CANNOT be fixed right now: brace-expansion 5.0.8 (needs 5.0.9) at node_modules/aws-cdk-lib/node_modules/brace-expansion, inBundle=true `aws-cdk-lib@2.263.0` is the latest published version and it bundles the vulnerable copy. Both remediation routes were tested and neither works: `npm audit fix` reports `fixAvailable: true`, runs, and leaves the lockfile byte-identical; an `overrides: {"brace-expansion": "^5.0.9"}` also leaves it at 5.0.8, because overrides cannot reach inside a third-party bundled tarball. This is the same shape as the earlier bundled-CVE work. It clears when upstream publishes a cdk-lib that bundles 5.0.9 — there is no action available to this repository, and claiming otherwise would be the "fixAvailable" lie repeated. Tested: 3711 passed / 6 skipped (unit + regression); IaC E2E under TS 6 — tsc exit 0, 8/8 stack tests, cdk synth 9 stacks; ruff clean; make ci green. --- .github/dependabot.yml | 16 ++++++++++------ iac-cdk/package-lock.json | 8 ++++---- iac-cdk/package.json | 2 +- tests/test_iac_toolchain_pins.py | 25 +++++++++++++++---------- 4 files changed, 30 insertions(+), 21 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3cb065e..89e17fc 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -53,12 +53,16 @@ updates: - "typescript" - "ts-node" - "@types/*" - # TypeScript is held at 5.x, with evidence rather than caution. Tested empirically: - # under 7.0.2 `tsc --noEmit` is CLEAN (the 7 x TS2591 "Cannot find name 'process'" - # errors were only a missing `types: ["node"]`, now declared in tsconfig.json), but - # ALL 8 stack tests die at startup with `TypeError: Cannot read properties of - # undefined (reading 'fileExists')` — TS 7 is the native rewrite and no longer - # exposes the `ts.sys` JS surface that `ts-node` reads its tsconfig through. + # TypeScript is held below 7, with evidence rather than caution. Both majors were + # tested and they came out differently: + # + # 6.0.3 tsc exit 0 · 8/8 stack tests · cdk synth 9 stacks -> ADOPTED + # 7.0.2 tsc exit 0, but ALL 8 stack tests die at startup with + # `TypeError: Cannot read properties of undefined (reading 'fileExists')` + # + # TS 7 is the native rewrite and no longer exposes the `ts.sys` JS surface that + # `ts-node` reads its tsconfig through. The bound is at the measured break point, not + # at "no major upgrades" — 6 was a real upgrade that shipped. # # `.github/workflows/ci.yml` runs those tests via `npx ts-node` per file (no jest), # so adopting TS 7 means the IaC test layer cannot start at all. Lifting this needs a diff --git a/iac-cdk/package-lock.json b/iac-cdk/package-lock.json index d26454b..733ea37 100644 --- a/iac-cdk/package-lock.json +++ b/iac-cdk/package-lock.json @@ -16,7 +16,7 @@ "@types/node": "^26.1.2", "aws-cdk": "^2.1134.0", "ts-node": "^10.9.2", - "typescript": "~5.7.2" + "typescript": "~6.0.3" } }, "node_modules/@aws-cdk/asset-awscli-v1": { @@ -478,9 +478,9 @@ } }, "node_modules/typescript": { - "version": "5.7.3", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.7.3.tgz", - "integrity": "sha512-84MVSjMEHP+FQRPy3pX9sTVV/INIex71s9TL2Gm5FG/WG1SqXeKyZ0k7/blY/4FdOzI12CBy1vGc4og/eus0fw==", + "version": "6.0.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz", + "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==", "dev": true, "license": "Apache-2.0", "bin": { diff --git a/iac-cdk/package.json b/iac-cdk/package.json index e6b80e5..4d7ad82 100644 --- a/iac-cdk/package.json +++ b/iac-cdk/package.json @@ -15,7 +15,7 @@ "@types/node": "^26.1.2", "aws-cdk": "^2.1134.0", "ts-node": "^10.9.2", - "typescript": "~5.7.2" + "typescript": "~6.0.3" }, "dependencies": { "aws-cdk-lib": "^2.263.0", diff --git a/tests/test_iac_toolchain_pins.py b/tests/test_iac_toolchain_pins.py index 570340d..d950b4f 100644 --- a/tests/test_iac_toolchain_pins.py +++ b/tests/test_iac_toolchain_pins.py @@ -5,20 +5,25 @@ `npx ts-node test/.test.ts` — there is no jest. That makes `ts-node` load-bearing CI infrastructure, and it constrains which TypeScript major this project can adopt. -Round 23 tested the Dependabot TypeScript 7.0 proposal empirically rather than declining -it on caution: +Round 23 tested both Dependabot TypeScript proposals empirically rather than declining them +on caution, and they came out differently: - tsc --noEmit under 7.0.2 CLEAN, once `types: ["node"]` is declared. The 7 x - TS2591 "Cannot find name 'process'" errors were an - implicit-@types regression, not incompatible code. - npx ts-node test/*.test.ts ALL 8 die at startup: - TypeError: Cannot read properties of undefined - (reading 'fileExists') + TS 6.0.3 tsc --noEmit exit 0 · 8/8 stack tests · cdk synth 9 stacks -> ADOPTED + TS 7.0.2 tsc --noEmit exit 0, but ALL 8 stack tests die at startup: + TypeError: Cannot read properties of undefined (reading 'fileExists') + at readConfig (node_modules/ts-node/dist/configuration.js:91:33) TS 7 is the native rewrite and no longer exposes the `ts.sys` JS surface `ts-node` reads its tsconfig through. So the blocker is the RUNNER, not the code — and adopting TS 7 needs -a runner migration (tsx, `node --experimental-strip-types`, or jest+swc) as its own -change. +a runner migration (tsx, `node --experimental-strip-types`, or jest+swc) as its own change. + +That difference is why the pin is `>= 7`, drawn at the measured break point rather than +"no major upgrades". TS 6 was a real upgrade that shipped. + +The implicit-`@types` removal — the cause of the 7 x TS2591 "Cannot find name 'process'" +errors — landed in **6.0**, not 7. Verified by removing `types: ["node"]` under 6.0.3 and +watching them return. So that one-line tsconfig fix is what unblocked the 6.0 upgrade, and +it was correct on its own terms before either upgrade was attempted. This file keeps that decision from rotting in either direction: