This repository was archived by the owner on Sep 11, 2026. It is now read-only.
chore: adopt core's TypeScript 6 and 7 arrangement - #325
Merged
Merged
Conversation
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring alerts on:
|
Contributor
Author
|
@metamaskbot publish-preview |
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
2 times, most recently
from
September 7, 2026 12:31
62142bc to
9962b7e
Compare
Contributor
Author
|
@metamaskbot publish-preview |
Contributor
|
The following preview build has been published: |
Base automatically changed from
migrate/pr2j-drop-node-18-20
to
migrate/pr2i-esm-only
September 8, 2026 12:39
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 8, 2026 12:39
9962b7e to
212dda1
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 8, 2026 17:00
212dda1 to
9962b7e
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 8, 2026 18:50
9962b7e to
fdb61df
Compare
cryptodev-2s
removed this pull request from stack #329
September 9, 2026 11:46
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 9, 2026 11:47
fdb61df to
41a7d57
Compare
cryptodev-2s
added this pull request to stack #331
September 9, 2026 11:47
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 9, 2026 16:09
41a7d57 to
9b64ee8
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
2 times, most recently
from
September 9, 2026 16:32
4a62b88 to
65ff5cc
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 9, 2026 19:13
65ff5cc to
04d2445
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 10:41
a499297 to
0088aac
Compare
cryptodev-2s
added this pull request to stack #335
September 10, 2026 10:41
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 11:05
0088aac to
0a710ce
Compare
Mrtenz
approved these changes
Sep 10, 2026
stack merge was automatically disabled
September 10, 2026 11:13
Pull Request is not mergeable
Contributor
Author
|
@SocketSecurity ignore npm/typescript@7.0.2 |
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 12:46
0a710ce to
63bdfd6
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 13:03
63bdfd6 to
6745d90
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 13:08
6745d90 to
4a23f92
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 13:15
4a23f92 to
fea36ab
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 13:21
fea36ab to
616454f
Compare
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 13:27
616454f to
b8367f5
Compare
cryptodev-2s
added a commit
that referenced
this pull request
Sep 10, 2026
Replaces #324, which GitHub auto-closed as merged during a stack reorder when its head briefly became an ancestor of its base. The changes never reached `main`; this carries the same two commits. Mirrors [MetaMask/core#9976](MetaMask/core#9976), the bottom of core's foundational stack. | | Before | After | | --- | --- | --- | | `engines.node` | `^18.18 \|\| ^20.14 \|\| >=22` | `^22.14.0 \|\| ^24` | | `@types/node` | `~18.18.14` | `^22.13.14` | | CI matrix | 18, 20, 22 | 22, 24 | `constraints.pro` is updated so `yarn constraints` enforces the new range. Core makes the `@types/node` bump in this same PR rather than with its TypeScript change, since the types track the supported runtime. ## Position in the stack This now sits **below** the ESM conversion (#323), so everything up to and including this PR is still a hybrid CJS/ESM build: ``` main → … → #322 → this → #323 (ESM only) → #325 (TypeScript) ``` That matters for testing. A preview build from here still resolves through `main: ./dist/index.cjs` with the `require` condition intact, so it can be consumed by `metamask-extension` as-is. Everything below the ESM cut can therefore be verified against a real downstream consumer before the breaking change lands. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Semver-breaking runtime requirement may block consumers still on Node 18 or 20; in-repo changes are mostly policy, CI, and test cleanup with limited logic impact. > > **Overview** > **Breaking:** supported Node is now `^22.14.0 || ^24` instead of 18/20/22. That is enforced in `package.json`, `constraints.pro`, and documented under Unreleased in `CHANGELOG.md`. > > CI **prepare**, **test**, and **compatibility-test** jobs now run on Node **22.x** and **24.x** only (18 and 20 dropped from the matrix). Dev typings move from `@types/node` ~18 to **^22.13.14**, with matching `yarn.lock` updates. > > Test and lint tooling align with the new floor: ESLint comments for `n/no-unsupported-features/node-builtins` reflect that global `crypto` is expected on 22+, and `hashing.test.ts` drops the Node 18 `webcrypto` polyfill/`beforeEach` setup—tests assume `globalThis.crypto.subtle` exists. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit ba81eca. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 13:33
b8367f5 to
777c7e5
Compare
Mirrors MetaMask/core#9518. packageManager yarn@4.16.0 -> yarn@4.17.1 typescript ~5.3.3 -> npm:@typescript/typescript6@^6.0.2 @typescript/native added -> npm:typescript@^7.0.2 A plain bump to TypeScript 7 does not work, for two separate reasons found by trying it: Yarn 4.16.0 auto applies a builtin compat/typescript patch that targets lib/_tsc.js. That file does not exist in 7, which is the native port with a different layout, so the install fails outright. Yarn 4.17.1 fixes it, which is why core bumps the package manager in the same PR. typescript-eslint then hard errors on TS 7: "typescript-eslint does not support TS 7.0 ... to run typescript-eslint using the TS 6 API". Tracked upstream at typescript-eslint/typescript-eslint#10940. So the aliases are not incidental. Resolving `typescript` to the TS 6 API is what keeps typescript-eslint, ts-jest and typedoc working, while TS 7 sits alongside as @typescript/native. Compilation runs on 6.0.3; nothing in the toolchain can consume 7 yet. Two source changes were needed, both from Uint8Array becoming generic: hashing.ts crypto.subtle.digest takes a BufferSource, which no longer accepts a plain Uint8Array because the buffer could be a SharedArrayBuffer. Asserted at the three call sites rather than narrowing the exported signatures, which would break callers. errors.ts no-base-to-string now sees that String(error) can produce "[object Object]". That is the documented fallback of getErrorMessage, so it is suppressed with a reason. Core's third entry, @typescript/old, is a patched 6.0.3 pointing at a patch file in core's own .yarn/patches. Nothing here needs it and its contents are not reproducible from outside that repo, so it is left out.
The ts-jest transform compiles the tests to CommonJS with node10 resolution, which TS 6 now reports as TS5107. Core adds the same ignoreDeprecations: '6.0' to its transform in MetaMask/core#9518. Only CI caught this: a stale ts-jest cache locally was still serving output compiled before the TypeScript change, so test:source passed here until the cache was cleared.
cryptodev-2s
force-pushed
the
migrate/pr2k-typescript
branch
from
September 10, 2026 13:40
777c7e5 to
aac3fa4
Compare
cryptodev-2s
added a commit
that referenced
this pull request
Sep 10, 2026
Top of stack #331, on #325. Mirrors [MetaMask/core#10019](MetaMask/core#10019), the last of core's foundational chain. | | Before | After | | --- | --- | --- | | `target` | `ES2020` | `ES2022` | | `lib` | `["ES2020", "DOM"]` | `["ES2022", "DOM"]` | Correctly last in the order: raising the emit target is only defensible once the Node floor guarantees the runtime supports it, which #328 established. ## It is not cosmetic `wrapError` sets `cause` behind two `@ts-ignore` comments, with this note in the source: > Error causes are not supported by our current tsc target (ES2020, we need ES2022 to make this work) `Error.cause` is ES2022, so both suppressions are now obsolete and are removed. The types are genuine rather than ignored. The evidence came from enabling test type checking: with `lib: ES2020` a `tsc` pass over the tests reports **11 errors**, nearly all `Property 'cause' does not exist`. With `lib: ES2022` it reports **zero**. That is why the type checking PR stacks on top of this one rather than below it. ## Verification Build, tests, tsd, eslint and lint all pass. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Breaking for consumers on older runtimes or TS configs that assumed ES2020 output; error utilities are widely used but the change is configuration and type hygiene rather than new logic. > > **Overview** > **BREAKING:** Raises the TypeScript **`target`** and **`lib`** from **ES2020** to **ES2022**, so published output expects a modern runtime or bundler that can consume ES2022. The unreleased changelog documents this alongside the existing Node/ESM breaking changes. > > In **`wrapError`**, the **`Error(message, { cause })`** path no longer needs **`@ts-ignore`** or the comment about ES2020 lacking **`Error.cause`** types—ES2022 **`lib`** makes **`cause`** a first-class typed option. > > No runtime behavior change in **`wrapError`** beyond what was already implemented; this is primarily a compile/emit floor and type-checking cleanup that unblocks stricter test **`tsc`** (e.g. **`cause`** on errors) in follow-up work. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6242b3e. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Top of stack #315, on #324. Mirrors MetaMask/core#9518.
packageManageryarn@4.16.0yarn@4.17.1typescript~5.3.3npm:@typescript/typescript6@^6.0.2@typescript/nativenpm:typescript@^7.0.2Why not just bump to TypeScript 7
I tried that first. It fails for two independent reasons:
1. Yarn. 4.16.0 auto-applies a builtin
compat/typescriptpatch targetinglib/_tsc.js. That file doesn't exist in TS 7, which is the native port with a different layout, so the install fails outright:Yarn 4.17.1 resolves it, which is why core bumps the package manager in the same PR.
2. typescript-eslint. With the install fixed, linting then hard-errors:
Tracked upstream at typescript-eslint#10940.
So the aliases aren't incidental overhead. Resolving
typescriptto the TS 6 API is what keepstypescript-eslint,ts-jestandtypedocworking, while TS 7 sits alongside as@typescript/native. Compilation runs on 6.0.3; nothing in the toolchain can consume 7 yet. Same position core is in.Source changes
Two, both from
Uint8Arraybecoming generic:hashing.ts—crypto.subtle.digesttakes aBufferSource, which no longer accepts a plainUint8Arraybecause the buffer could be aSharedArrayBuffer. Asserted at the three call sites rather than narrowing the exported signatures, which would break callers.errors.ts—no-base-to-stringnow sees thatString(error)can produce[object Object]. That is the documented fallback ofgetErrorMessage, so it's suppressed with a reason.Not carried over
Core's third entry,
@typescript/old, is a patched 6.0.3 pointing at a patch file in core's own.yarn/patches. Nothing here needs it and its contents aren't reproducible from outside that repo.Note
Medium Risk
Toolchain-wide TypeScript/Yarn changes can surface build or lint regressions; hashing changes touch crypto paths but preserve digest output via the noble fallback.
Overview
Aligns the repo with MetaMask core’s TypeScript 6 + native TS 7 setup:
typescriptresolves to@typescript/typescript6@^6.0.2(so typescript-eslint, ts-jest, and typedoc keep working), adds@typescript/native(TS 7) alongside, bumps Yarn to 4.17.1, and refreshes the lockfile.Jest/ts-jest gets
ignoreDeprecations: '6.0'so test compilation can keepmoduleResolution: 'Node'under TS 6 without noise.Two small source fixes for stricter TS 6 types:
hashing.tsonly callscrypto.subtle.digestwhen input bytes are backed by anArrayBuffer(otherwise noble), avoiding runtime errors onSharedArrayBufferviews while keeping public APIs unchanged.getErrorMessageadds a targetedno-base-to-stringsuppression for the intentionalString(error)fallback.Reviewed by Cursor Bugbot for commit aac3fa4. Bugbot is set up for automated code reviews on this repo. Configure here.