Bump typescript from 6.0.3 to 7.0.2

[dependabot]

Bumps typescript from 6.0.3 to 7.0.2.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bgentry]

🤖 Codex review: Not approved because the compatibility gate fails.

Upgrade

• typescript: 6.0.3 → 7.0.2
• Reviewed head: b56e03772aee13677a0b7bedd229c0a5c9e4fc5a

Security review

• The direct package uses the canonical Microsoft TypeScript registry/repository identity, and its lockfile SHA-512 matches npm metadata.
• TypeScript 7 introduces the expected platform-specific native compiler packages. No install lifecycle hook is added, but this is a materially larger binary trust surface than TypeScript 6.

Compatibility verification

• npm ci fails with ERESOLVE: typescript-eslint@8.65.0 requires typescript >=4.8.4 <6.1.0.
• JS build/test, lint, release, and image checks consequently fail before useful project validation can run.
• This PR contains no independent dependency update to extract; every added lockfile package belongs to TypeScript 7's platform compiler distribution.

Residual risk / blocker

• Keep this PR unmerged until the lint/Astro toolchain declares TypeScript 7 compatibility and the native compiler artifacts can be validated as part of a viable update.

[bgentry]

🤖 Codex follow-up review: Not approved; the security and compatibility gates remain blocked.

Upgrade

• typescript: 6.0.3 → 7.0.2
• Reviewed head: b56e03772aee13677a0b7bedd229c0a5c9e4fc5a

Security review

• All 22 exact npm tarballs (the wrapper, old package, and 20 new platform packages) were inspected without execution. Their SHA-512 values match both npm metadata and the lockfile; no lifecycle hooks, non-registry URLs, same-version integrity rewrites, or suspicious wrapper behavior were found.
• TypeScript 7 newly executes platform-native compiler binaries. Both exact macOS binaries contain Microsoft Team ID UBF8T346G9 signatures, but codesign --verify --deep --strict --verbose=6 reports invalid signature (code or signature have been modified) for each.
• npm publishes no provenance attestations for these artifacts. The Linux/BSD/AIX PGP sidecars and Windows Authenticode signatures could not be independently verified in this environment. This does not prove compromise, but it leaves the new native-binary trust surface inconclusive.

Compatibility verification

• Exact-head CI fails during npm ci: typescript-eslint@8.65.0 requires TypeScript >=4.8.4 <6.1.0.
• JS build/test, lint, release, and downstream image jobs therefore do not reach meaningful validation.

Residual risk / blocker

• Do not merge until Microsoft explains or corrects the invalid macOS signatures, the remaining platform signatures can be validated as practical, and the lint/tooling stack explicitly supports TypeScript 7 with the full repository checks passing.