Skip to content

chore: adopt core's TypeScript 6 and 7 arrangement - #325

Open
cryptodev-2s wants to merge 2 commits into
migrate/pr2j-drop-node-18-20from
migrate/pr2k-typescript
Open

chore: adopt core's TypeScript 6 and 7 arrangement#325
cryptodev-2s wants to merge 2 commits into
migrate/pr2j-drop-node-18-20from
migrate/pr2k-typescript

Conversation

@cryptodev-2s

@cryptodev-2s cryptodev-2s commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

Top of stack #315, on #324. Mirrors MetaMask/core#9518.

Before After
packageManager yarn@4.16.0 yarn@4.17.1
typescript ~5.3.3 npm:@typescript/typescript6@^6.0.2
@typescript/native npm:typescript@^7.0.2

Why not just bump to TypeScript 7

I tried that first. It fails for two independent reasons:

1. Yarn. 4.16.0 auto-applies a builtin compat/typescript patch targeting lib/_tsc.js. That file doesn't exist in TS 7, which is the native port with a different layout, so the install fails outright:

typescript@patch:typescript@npm%3A7.0.2#optional!builtin<compat/typescript>
ENOENT: no such file or directory, lstat '.../typescript/lib/_tsc.js'

Yarn 4.17.1 resolves it, which is why core bumps the package manager in the same PR.

2. typescript-eslint. With the install fixed, linting then hard-errors:

typescript-eslint does not support TS 7.0.
Please see ... to run typescript-eslint using the TS 6 API.

Tracked upstream at typescript-eslint#10940.

So the aliases aren't incidental overhead. Resolving typescript to the TS 6 API is what keeps typescript-eslint, ts-jest and typedoc working, while TS 7 sits alongside as @typescript/native. Compilation runs on 6.0.3; nothing in the toolchain can consume 7 yet. Same position core is in.

Source changes

Two, both from Uint8Array becoming generic:

  • hashing.tscrypto.subtle.digest takes a BufferSource, which no longer accepts a plain Uint8Array because the buffer could be a SharedArrayBuffer. Asserted at the three call sites rather than narrowing the exported signatures, which would break callers.
  • errors.tsno-base-to-string now sees that String(error) can produce [object Object]. That is the documented fallback of getErrorMessage, so it's suppressed with a reason.

Not carried over

Core's third entry, @typescript/old, is a patched 6.0.3 pointing at a patch file in core's own .yarn/patches. Nothing here needs it and its contents aren't reproducible from outside that repo.


Note

Medium Risk
Toolchain and lockfile changes affect build, lint, and tests repo-wide; hashing edits are compile-time assertions only with unchanged runtime behavior.

Overview
Aligns the repo with MetaMask core’s dual TypeScript setup: primary typescript resolves to @typescript/typescript6@^6.0.2 (TS 6 API for tsc, eslint, jest, typedoc), @typescript/native adds TS 7 alongside, and Yarn bumps to 4.17.1 so installs don’t break on TS 7’s layout.

Jest/ts-jest sets ignoreDeprecations: '6.0' so test compilation can keep moduleResolution: 'Node' under TS 6 without deprecation noise.

Two small source fixes for stricter TS 6/7 typing: hashing.ts casts Uint8Array to BufferSource at crypto.subtle.digest call sites (keeps public Uint8Array signatures); errors.ts documents and suppresses no-base-to-string on the intentional String(error) fallback in getErrorMessage.

Reviewed by Cursor Bugbot for commit 9962b7e. Bugbot is set up for automated code reviews on this repo. Configure here.

@socket-security

socket-security Bot commented Sep 5, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​typescript/​typescript6@​6.0.21001005588100
Updatedtypescript@​5.3.3 ⏵ 7.0.29910089 -1100100 +10

View full report

@socket-security

socket-security Bot commented Sep 5, 2026

Copy link
Copy Markdown

Caution

MetaMask internal reviewing guidelines:

  • Do not ignore-all
  • Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
  • Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
    @SocketSecurity ignore npm/PACKAGE@VERSION
Action Severity Alert  (click "▶" to expand/collapse)
Block Low
Publisher changed: npm @typescript/typescript-aix-ppc64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-aix-ppc64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-aix-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-darwin-arm64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-darwin-arm64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-darwin-x64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-darwin-x64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-darwin-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-freebsd-arm64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-freebsd-arm64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-freebsd-x64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-freebsd-x64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-freebsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-linux-arm is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-linux-arm@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-linux-arm64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-linux-arm64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-linux-loong64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-linux-loong64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-loong64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-linux-mips64el is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-linux-mips64el@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-mips64el@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-linux-ppc64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-linux-ppc64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-ppc64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-linux-riscv64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-linux-riscv64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-riscv64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-linux-s390x is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-linux-s390x@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-s390x@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-linux-x64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-linux-x64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-linux-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-netbsd-arm64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-netbsd-arm64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-netbsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-netbsd-x64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-netbsd-x64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-netbsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-openbsd-arm64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-openbsd-arm64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-openbsd-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-openbsd-x64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-openbsd-x64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-openbsd-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-sunos-x64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-sunos-x64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-sunos-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-win32-arm64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-win32-arm64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-win32-arm64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm @typescript/typescript-win32-x64 is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2npm/@typescript/typescript-win32-x64@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@typescript/typescript-win32-x64@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Block Low
Publisher changed: npm typescript is now published by microsoft1es instead of typescript-deploys

New Author: microsoft1es

Previous Author: typescript-deploys

From: package.jsonnpm/typescript@7.0.2

ℹ Read more on: This package | This alert | What is new author?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@7.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@cryptodev-2s

Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

Mirrors MetaMask/core#9518.

  packageManager      yarn@4.16.0 -> yarn@4.17.1
  typescript          ~5.3.3      -> npm:@typescript/typescript6@^6.0.2
  @typescript/native  added       -> npm:typescript@^7.0.2

A plain bump to TypeScript 7 does not work, for two separate reasons found
by trying it:

  Yarn 4.16.0 auto applies a builtin compat/typescript patch that targets
  lib/_tsc.js. That file does not exist in 7, which is the native port with
  a different layout, so the install fails outright. Yarn 4.17.1 fixes it,
  which is why core bumps the package manager in the same PR.

  typescript-eslint then hard errors on TS 7: "typescript-eslint does not
  support TS 7.0 ... to run typescript-eslint using the TS 6 API". Tracked
  upstream at typescript-eslint/typescript-eslint#10940.

So the aliases are not incidental. Resolving `typescript` to the TS 6 API is
what keeps typescript-eslint, ts-jest and typedoc working, while TS 7 sits
alongside as @typescript/native. Compilation runs on 6.0.3; nothing in the
toolchain can consume 7 yet.

Two source changes were needed, both from Uint8Array becoming generic:

  hashing.ts  crypto.subtle.digest takes a BufferSource, which no longer
              accepts a plain Uint8Array because the buffer could be a
              SharedArrayBuffer. Asserted at the three call sites rather
              than narrowing the exported signatures, which would break
              callers.

  errors.ts   no-base-to-string now sees that String(error) can produce
              "[object Object]". That is the documented fallback of
              getErrorMessage, so it is suppressed with a reason.

Core's third entry, @typescript/old, is a patched 6.0.3 pointing at a patch
file in core's own .yarn/patches. Nothing here needs it and its contents are
not reproducible from outside that repo, so it is left out.
The ts-jest transform compiles the tests to CommonJS with node10 resolution,
which TS 6 now reports as TS5107. Core adds the same ignoreDeprecations: '6.0'
to its transform in MetaMask/core#9518.

Only CI caught this: a stale ts-jest cache locally was still serving output
compiled before the TypeScript change, so test:source passed here until the
cache was cleared.
@cryptodev-2s
cryptodev-2s force-pushed the migrate/pr2k-typescript branch 2 times, most recently from 62142bc to 9962b7e Compare September 7, 2026 12:31
@cryptodev-2s

Copy link
Copy Markdown
Contributor Author

@metamaskbot publish-preview

@github-actions

github-actions Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

The following preview build has been published:

@metamask-previews/utils@11.12.1-preview-9962b7e

Learn how to use preview builds in other projects.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant