Repository navigation
build(web): move to TypeScript 6.0 and patch Monaco's DOMPurify - #31
Merged
Merged
Conversation
TypeScript 6.0.3 is the newest release typescript-eslint supports. An npm override lets openapi-typescript (which declares ^5) use it; the regenerated API types are identical. Monaco 0.57 pins DOMPurify 3.4.15, which has several XSS advisories; an override points it at our own 3.4.17.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TypeScript 5.9.3 → 6.0.3
TypeScript 7 (the native compiler) can't be used yet: typescript-eslint 8.72 supports
<6.1because it depends on the TypeScript JS API that 7 doesn't provide. 6.0.3 is the newest version it supports.openapi-typescript 7.13 declares a
^5peer (no release since February), sopackage.jsongets anoverridesentry letting it use our TypeScript. It's only used bymake api-types; regenerating with 6.0.3 produces identicalopenapi.jsonandsrc/generated/api.ts.DOMPurify in Monaco
npm auditflagged a critical issue already present on main: Monaco 0.57 pinsdompurify3.4.15, affected by several XSS advisories (GHSA-p98j-92pf-mc4p and others, fixed in 3.4.17). An override points Monaco at our own direct dependency, 3.4.17 (patch-level).npm audit --omit=devnow reports 0 vulnerabilities.The remaining dev-only finding is minimatch (moderate ReDoS) inside ESLint and openapi-typescript's tooling; the fix needs a major ESLint doesn't support, and it only processes our own glob patterns.
Testing
tsc -b,make lint, web tests (17) andvite buildpass on TypeScript 6.0.3.