Bump typescript from 5.9.3 to 6.0.2

[dependabot]

Bumps typescript from 5.9.3 to 6.0.2.

Release notes

Sourced from typescript's releases.

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• 607a22a Bump version to 6.0.2 and LKG
• 9e72ab7 🤖 Pick PR #63239 (Fix missing lib files in reused pro...) into release-6.0 (#...
• 35ff23d 🤖 Pick PR #63163 (Port anyFunctionType subtype fix an...) into release-6.0 (#...
• e175b69 Bump version to 6.0.1-rc and LKG
• af4caac Update LKG
• 8efd7e8 Merge remote-tracking branch 'origin/main' into release-6.0
• 206ed1a Deprecate assert in import() (#63172)
• e688ac8 Update dependencies (#63156)
• 29b300d Bump the github-actions group across 1 directory with 2 updates (#63205)
• 0c2c7a3 DOM update (#63183)
• Additional commits viewable in compare view

[fossabot]

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because it introduces two confirmed breaking TypeScript compilation errors that cause CI to fail entirely. First, the new compiler requires rootDir to be explicitly declared in tsconfig.json — it is currently commented out on line 15, triggering TS5011 across both rebuild-dist and fossa-scan CI jobs. Second, the new compiler changed the default value of the types array from auto-including all @​types/* packages to an empty array, meaning Node.js globals (process, Buffer) and the node:fs module import — all heavily used across src/index.ts and src/download-cli.ts — can no longer be resolved, producing TS2591 errors. Both issues have straightforward mitigations in tsconfig.json only (no code changes needed): uncomment "rootDir": "./src" on line 15, and uncomment/add "types": ["node"] on line 43; @​types/node is already present as a devDependency in package.json. Additionally, 11 compiler options used or referenced in the project (--module syntax, downlevelIteration, alwaysStrict, allowSyntheticDefaultImports, baseUrl, --moduleResolution node10, --outFile, import assert, target, --module amd/umd, esModuleInterop) are now deprecated and will be removed in the next major version, so a broader tsconfig.json audit is advisable before merging.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 3 fixable issues in this upgrade.

• Uncomment and set rootDir in tsconfig.json line 15: change // "rootDir": "./", to "rootDir": "./src",. TypeScript 6 requires an explicit rootDir when source files are in a subdirectory, triggering TS5011 without it.
  Files: tsconfig.json
• Uncomment and set types in tsconfig.json line 43: change // "types": [], to "types": ["node"],. TypeScript 6 changed the default types from auto-including all @​types/* packages to an empty array. Adding "node" restores Node.js global type resolution (process, Buffer, node:fs) and fixes all TS2591 errors. @​types/node is already in devDependencies so no package install is needed.
  Files: tsconfig.json
• Audit tsconfig.json for deprecated TypeScript 6 compiler options and update them. Specifically: (1) Search for "downlevelIteration" — if present and set, consider removing it as it is deprecated in TS6. (2) Search for "alwaysStrict" — if present and set to false, remove it (deprecated; strictness is now controlled solely by "strict"). (3) Search for "allowSyntheticDefaultImports" — if present, consider removing it (deprecated in favor of esModuleInterop). (4) Search for "baseUrl" — if set only for path resolution (not path aliases), consider removing it (deprecated for that purpose). (5) Check "moduleResolution" — if set to "node" or "node10", change to "node16" or "nodenext" ("node10" is deprecated). (6) Check "module" — if set to "amd", "umd", "system", or "none", update to a supported value like "node16" or "nodenext". These are not currently causing build failures but will be removed in the next TypeScript major version.
  Files: tsconfig.json

AI Assistant Prompt

Copy prompt for AI assistant

# Fix TypeScript 6.0.2 Upgrade – Breaking CI Errors

This project (a GitHub Action written in TypeScript) has upgraded `typescript` from v5 to v6.0.2 via Dependabot. The upgrade breaks CI (`rebuild-dist` and `fossa-scan` jobs) with two TypeScript compilation errors during `yarn build`. Both fixes are in `tsconfig.json` only — no source code changes are needed.

## File to edit: `tsconfig.json`

### Fix 1: TS5011 — rootDir must be explicitly set

**Error:** `TS5011: The common source directory of tsconfig.json is ./src. The rootDir setting must be explicitly set.`

TypeScript 6 requires `rootDir` to be explicitly declared when source files are in a subdirectory.

**Change:** Find the commented-out `rootDir` line (around line 15):
```
// "rootDir": "./",
```
Uncomment it and change the value to `"./src"`:
```
"rootDir": "./src",
```

### Fix 2: TS2591 — Node.js globals not resolved

**Error:** `TS2591: Cannot find name 'process'`, `Cannot find name 'Buffer'`, `Cannot resolve module 'node:fs'` across `src/index.ts` and `src/download-cli.ts`.

TypeScript 6 changed the default `types` compiler option from auto-including all `@​types/*` packages to an empty array. Node.js globals are no longer implicitly available.

**Change:** Find the commented-out `types` line (around line 43):
```
// "types": [],
```
Uncomment it and add `"node"` to the array:
```
"types": ["node"],
```

`@​types/node` is already listed in `package.json` devDependencies, so no package install is needed.

### Fix 3 (Recommended): Audit deprecated compiler options

These options are deprecated in TypeScript 6 and will be removed in TypeScript 7. They produce warnings now but won't break the build yet. Review `tsconfig.json` for these and update as appropriate:

1. **`"downlevelIteration"`** — If present, consider removing it (deprecated in TS6).
2. **`"alwaysStrict"`** — If set to `false`, remove it (`--strict` now defaults to `true` in TS6).
3. **`"allowSyntheticDefaultImports"`** — If present, consider removing (deprecated in favor of `esModuleInterop`).
4. **`"baseUrl"`** — If set only for module resolution (not path aliases), consider removing.
5. **`"moduleResolution"`** — If set to `"node"` or `"node10"`, change to `"node16"` or `"nodenext"` (`"node10"` is deprecated).
6. **`"module"`** — If set to `"amd"`, `"umd"`, `"system"`, or `"none"`, update to a supported value like `"node16"` or `"nodenext"`.

## Verification

After making changes, run:
```bash
yarn build
```
This should complete without TS5011 or TS2591 errors.

## Summary of changes needed

| File | Line (approx) | Change | Fixes |
|------|--------------|--------|-------|
| `tsconfig.json` | ~15 | Uncomment `rootDir`, set to `"./src"` | TS5011 |
| `tsconfig.json` | ~43 | Uncomment `types`, set to `["node"]` | TS2591 |
| `tsconfig.json` | various | Audit/update deprecated options | Future-proofing for TS7 |

What we checked

• rootDir is commented out: // "rootDir": "./",. TypeScript 6 changed the default to the tsconfig directory (.) instead of inferring it, and now requires an explicit "rootDir": "./src" declaration when sources reside in a subdirectory — triggering TS5011 at build time. ^[1]
• types is commented out: // "types": [],. TypeScript 6 now defaults types to an empty array instead of auto-including all @​types/* packages. Without "types": ["node"], Node.js globals like process and Buffer and the node:fs module cannot be resolved, causing TS2591 errors throughout the build. ^[2]
• The devDependencies entry "typescript": "^6.0.2" confirms this Dependabot PR bumps to the new major version, which introduced the compiler defaults changes triggering the CI failures. ^[3]
• "@​types/node": "^24.0.0" is already present as a devDependency, so no additional package installation is needed — only the tsconfig.json types array fix is required. ^[4]
• import * as fs from 'node:fs' — this import fails with TS2591: Cannot find name 'node:fs' because Node.js types are not loaded under TypeScript 6's new empty-array types default. ^[5]
• process.platform — fails with TS2591: Cannot find name 'process' under the new types default; Node.js globals are no longer implicitly available. ^[6]
• stdout: (data: Buffer) => — fails with TS2591: Cannot find name 'Buffer'; same root cause as process — Node.js global types are not resolved. ^[7]
• const collectOutput = (data: Buffer) => — fails with TS2591: Cannot find name 'Buffer', one of multiple Buffer usages in src/index.ts that break under the new types default. ^[8]
• const PATH = process.env.PATH || '' — fails with TS2591: Cannot find name 'process'; process is referenced at lines 73, 75, 140, and 142 across two separate functions. ^[9]
• "strict": false is explicitly set. TypeScript 6 changed the strict default to true, but since this project sets it explicitly, it won't silently become stricter. However, the related alwaysStrict: false option is now deprecated and no longer respected — teams should be aware of this behavioral drift. ^[10]
• Official TypeScript 6.0 announcement documenting the types default change (empty array instead of all @​types/*), rootDir default change (tsconfig directory instead of inferred), and deprecation of --module amd/umd/system/none, --outFile, --moduleResolution classic/node10, --baseUrl, --downlevelIteration, target: es5, import assertions, esModuleInterop false, allowSyntheticDefaultImports false, and alwaysStrict false. ^[11]
• Official TypeScript 6.0 migration tracking issue confirming: (1) add "rootDir" explicitly if output files are unexpectedly nested, (2) add "types": ["node"] to restore Node.js global type resolution after the empty-array default change. ^[12]

Dependency Usage

typescript is a foundational development toolchain dependency for this project — the entire codebase is authored in TypeScript, as evidenced by source files in src/ (including src/index.ts, src/config.ts, and src/download-cli.ts) and a tsconfig.json governing compilation. It works in concert with @​typescript-eslint/parser and @​typescript-eslint/eslint-plugin to enforce type-safe linting across the codebase. As a devDependency, typescript has no runtime presence but is essential to the build pipeline — it is the compiler that transforms all application source into executable JavaScript.

• import * as fs from 'node:fs' — this import fails with TS2591: Cannot find name 'node:fs' because Node.js types are not loaded under TypeScript 6's new empty-array types default.
  src/download-cli.ts:4
• process.platform — fails with TS2591: Cannot find name 'process' under the new types default; Node.js globals are no longer implicitly available.
  src/download-cli.ts:10

View 3 more usages

• stdout: (data: Buffer) => — fails with TS2591: Cannot find name 'Buffer'; same root cause as process — Node.js global types are not resolved.
  src/download-cli.ts:89
• const collectOutput = (data: Buffer) => — fails with TS2591: Cannot find name 'Buffer', one of multiple Buffer usages in src/index.ts that break under the new types default.
  src/index.ts:63
• const PATH = process.env.PATH || '' — fails with TS2591: Cannot find name 'process'; process is referenced at lines 73, 75, 140, and 142 across two separate functions.
  src/index.ts:73

Changes

typescript has been upgraded to a new major version with one security fix and a breaking change affecting inheritance of multiple bases with incompatible optional properties. Developers should also note that --strict now defaults to true, noUncheckedSideEffectImports is enabled by default, and numerous compiler options have been deprecated including --outFile, --downlevelIteration, --module amd/umd/system/none, --moduleResolution classic/node10, esModuleInterop, alwaysStrict: false, and baseUrl.

• Add extra test for extending multiple bases with incompatible optional properties (v5.9.3-6.0.2, commit)
• Update security.md (v5.9.3-6.0.2, commit)
• Deprecate assert in import() (v5.9.3-6.0.2, commit)

View 151 more changes

• fixed issues query for TypeScript v6.0.2. (v5.9.3-6.0.2, release notes)
• npm (v5.9.3-6.0.2, release notes)
• Fix missing lib files in reused projects (v5.9.3-6.0.2, commit)
• Port anyFunctionType subtype fix (v5.9.3-6.0.2, commit)
• Fix crash in declaration emit with nested binding patterns (v5.9.3-6.0.2, commit)
• Fix from and with method types of Temporal.PlainMonthDay (v5.9.3-6.0.2, commit)
• Un-consolidate and fix WeakMap constructor overloads (v5.9.3-6.0.2, commit)
• Fix RegExpIndicesArray by adding undefined to type definition (v5.9.3-6.0.2, commit)
• Fix JSX source location when react-jsx and whitespace before jsx (v5.9.3-6.0.2, commit)
• Fix tests that should have stayed ES5 (v5.9.3-6.0.2, commit)
• Fix crash caused by circularly-reentrant getEffectsSignature (v5.9.3-6.0.2, commit)
• Eliminate tests/lib/lib.d.ts and fix fourslash to use real libs (v5.9.3-6.0.2, commit)
• Fix transform crash with destructured parameter property (v5.9.3-6.0.2, commit)
• More test suite strictness fixups (v5.9.3-6.0.2, commit)
• Fix typo in JSDoc of Math.trunc(…) (v5.9.3-6.0.2, commit)
• Fix crash related to index type deferral on generic mapped types (v5.9.3-6.0.2, commit)
• Correctly split line endings for // @​testOption: value parsing (v5.9.3-6.0.2, commit)
• Fix "never nullish" diagnostic missing expressions wrapped in parentheses (v5.9.3-6.0.2, commit)
• Fix spurious "used before being assigned" errors in for-of loops (v5.9.3-6.0.2, commit)
• Fix crash in abstract property checking (v5.9.3-6.0.2, commit)
• Fix crash in mixin checking (v5.9.3-6.0.2, commit)
• Fix crash when adding unreachable code diagnostic with missing initializers (v5.9.3-6.0.2, commit)
• Fix typo: MERCHANTABLITY → MERCHANTABILITY (v5.9.3-6.0.2, commit)
• Fix accidental module replacements in tests (v5.9.3-6.0.2, commit)
• Fix String.prototype.matchAll type and description (v5.9.3-6.0.2, commit)
• Fix ContextFlags compile error (v5.9.3-6.0.2, commit)
• Widen reverse mapped type properties to fix EPC-valid treatment (v5.9.3-6.0.2, commit)
• Fix unreachable code detection persisting after incremental edits (v5.9.3-6.0.2, commit)
• Fix control flow analysis of aliased discriminants with parenthesized initializers (v5.9.3-6.0.2, commit)
• Fix [Symbol.iterator]() lost on union with never (v5.9.3-6.0.2, commit)
• Fix issue with "slow" sync iteration types spoiling cached value for async iterables (v5.9.3-6.0.2, commit)
• Fix TS2783 false positive for union types in object spread expressions (v5.9.3-6.0.2, commit)
• Fix crash when parsing invalid decorator on await expression (v5.9.3-6.0.2, commit)
• Fix fourslash tests (v5.9.3-6.0.2, commit)
• Fix discriminant property selection order-independence in unions (v5.9.3-6.0.2, commit)
• Consistently resolve to the errorType on arguments with error (v5.9.3-6.0.2, commit)
• Fix releaser tag creation (v5.9.3-6.0.2, commit)
• Fix incorrect test options (v5.9.3-6.0.2, commit)
• Fix error message TS1355 (v5.9.3-6.0.2, commit)
• Fix incorrectly ignored dts file from project reference for resolution (v5.9.3-6.0.2, commit)
• Fix parenthesizer rules for manually constructed binary expressions with ?? (v5.9.3-6.0.2, commit)
• Fix private identifier fields generating errors in class expression declarations (v5.9.3-6.0.2, commit)
• Add format to update baselines/fix lints task (v5.9.3-6.0.2, commit)
• Deprecate downlevelIteration (v5.9.3-6.0.2, commit)
• Deprecate alwaysStrict: false (v5.9.3-6.0.2, commit)
• Deprecate import assert in favor of import with (v5.9.3-6.0.2, commit)
• Default target to "latest standard" and deprecate ES5 (v5.9.3-6.0.2, commit)
• Deprecate --outFile (v5.9.3-6.0.2, commit)
• Deprecate module syntax (v5.9.3-6.0.2, commit)
• Deprecate --module amd, umd, system, none; --moduleResolution classic (v5.9.3-6.0.2, commit)
• Deprecate esModuleInterop and allowSyntheticDefaultImports (default to true) (v5.9.3-6.0.2, commit)
• Deprecate baseUrl (v5.9.3-6.0.2, commit)
• Deprecate --moduleResolution node10 (v5.9.3-6.0.2, commit)
• Add symbol name to error message for TS2742 (v5.9.3-6.0.2, commit)
• Add discrete pluralizer for lib.esnext.temporal unit unions (v5.9.3-6.0.2, commit)
• Add lib.esnext.temporal (v5.9.3-6.0.2, commit)
• Add approximatelySign to NumberFormatRangePartTypeRegistry for ES2023 (v5.9.3-6.0.2, commit)
• Implement Intl Locale Info proposal (v5.9.3-6.0.2, commit)
• Add proposal-upsert methods to lib.esnext.collection (v5.9.3-6.0.2, commit)
• Add --stableTypeOrdering for TS7 ordering compat (v5.9.3-6.0.2, commit)
• Add collation to Intl.CollatorOptions (v5.9.3-6.0.2, commit)
• Introduce ES2025 target & Add missing ScriptTargetFeatures (v5.9.3-6.0.2, commit)
• Add note re: PRs to CONTRIBUTING.md (v5.9.3-6.0.2, commit)
• Add tests for contextual param type assignment in nested return type inference (v5.9.3-6.0.2, commit)
• Add --ignoreConfig flag and disallow specifying files on commandline without it (v5.9.3-6.0.2, commit)
• Add missing whitespace after type parameter's modifiers in interactive inlay hints (v5.9.3-6.0.2, commit)
• Add allowJs default value description (v5.9.3-6.0.2, commit)
• Add type definitions for Uint8Array to/from base64 methods (v5.9.3-6.0.2, commit)
• Add missing Float16Array constructors (v5.9.3-6.0.2, commit)
• Bump version to 6.0.2 and LKG (v5.9.3-6.0.2, commit)
• Bump version to 6.0.1-rc and LKG (v5.9.3-6.0.2, commit)
• Update LKG (v5.9.3-6.0.2, commit)
• Merge remote-tracking branch 'origin/main' into release-6.0 (v5.9.3-6.0.2, commit)
• Update dependencies (v5.9.3-6.0.2, commit)
• Bump github-actions with multiple updates (v5.9.3-6.0.2, commit)
• DOM update (v5.9.3-6.0.2, commit)
• Eliminate interpolation from workflows (v5.9.3-6.0.2, commit)
• Update DOM types (v5.9.3-6.0.2, commit)
• Ensure node is installed in release publisher (v5.9.3-6.0.2, commit)
• Bump version to 6.0.0-beta and LKG (v5.9.3-6.0.2, commit)
• Always set up host in node builder (v5.9.3-6.0.2, commit)
• Document indexOf return value when not found (v5.9.3-6.0.2, commit)
• Return iterable of RegExpExecArray from RegExp#[Symbol.matchAll] (v5.9.3-6.0.2, commit)
• Update Map.clear and Set.clear jsdoc in es2015.collection.d.ts (v5.9.3-6.0.2, commit)
• Set default types array to []; support "*" wildcard (v5.9.3-6.0.2, commit)
• Update descriptions for strict-related flags (v5.9.3-6.0.2, commit)
• Disable macOS in PR CI (v5.9.3-6.0.2, commit)
• Switch the default of --strict to true (v5.9.3-6.0.2, commit)
• Hide omitted expression types in type baselines (v5.9.3-6.0.2, commit)
• Remove ES5 references and misc cleanup (v5.9.3-6.0.2, commit)
• Update implied default for module based on target (v5.9.3-6.0.2, commit)
• Be more lenient about iteration when lib=es5 / noLib (v5.9.3-6.0.2, commit)
• Remove compiler runner libFiles option entirely (v5.9.3-6.0.2, commit)
• Support FORCE_COLOR (v5.9.3-6.0.2, commit)
• Consult referenced project options for synthetic default export eligibility (v5.9.3-6.0.2, commit)
• Turn // @​strict off in failing fourslash tests (v5.9.3-6.0.2, commit)
• Explicitly set strict: false for project tests and eval tests (v5.9.3-6.0.2, commit)

View 54 more changes in the full analysis

References (12)

[1]: rootDir is commented out: // "rootDir": "./",. TypeScript 6 changed the default to the tsconfig directory (.) instead of inferring it, and now requires an explicit "rootDir": "./src" declaration when sources reside in a subdirectory — triggering TS5011 at build time.

fossa-action/tsconfig.json

Line 15 in 2273414

// "rootDir": "./", /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */

[2]: types is commented out: // "types": [],. TypeScript 6 now defaults types to an empty array instead of auto-including all @​types/* packages. Without "types": ["node"], Node.js globals like process and Buffer and the node:fs module cannot be resolved, causing TS2591 errors throughout the build.

fossa-action/tsconfig.json

Line 43 in 2273414

// "types": [], /* Type declaration files to be included in compilation. */

[3]: The devDependencies entry "typescript": "^6.0.2" confirms this Dependabot PR bumps to the new major version, which introduced the compiler defaults changes triggering the CI failures.

fossa-action/package.json

Line 37 in 2273414

"typescript": "^6.0.2"

[4]: "@​types/node": "^24.0.0" is already present as a devDependency, so no additional package installation is needed — only the tsconfig.json types array fix is required.

fossa-action/package.json

Line 23 in 2273414

"@types/node": "^24.0.0",

[5]: import * as fs from 'node:fs' — this import fails with TS2591: Cannot find name 'node:fs' because Node.js types are not loaded under TypeScript 6's new empty-array types default.

fossa-action/src/download-cli.ts

Line 4 in 2273414

import * as fs from 'node:fs';

[6]: process.platform — fails with TS2591: Cannot find name 'process' under the new types default; Node.js globals are no longer implicitly available.

fossa-action/src/download-cli.ts

Line 10 in 2273414

switch (process.platform) {

[7]: stdout: (data: Buffer) => — fails with TS2591: Cannot find name 'Buffer'; same root cause as process — Node.js global types are not resolved.

fossa-action/src/download-cli.ts

Line 89 in 2273414

stdout: (data: Buffer) => {

[8]: const collectOutput = (data: Buffer) => — fails with TS2591: Cannot find name 'Buffer', one of multiple Buffer usages in src/index.ts that break under the new types default.

fossa-action/src/index.ts

Line 63 in 2273414

const collectOutput = (data: Buffer) => {

[9]: const PATH = process.env.PATH || '' — fails with TS2591: Cannot find name 'process'; process is referenced at lines 73, 75, 140, and 142 across two separate functions.

fossa-action/src/index.ts

Line 73 in 2273414

const PATH = process.env.PATH || '';

[10]: "strict": false is explicitly set. TypeScript 6 changed the strict default to true, but since this project sets it explicitly, it won't silently become stricter. However, the related alwaysStrict: false option is now deprecated and no longer respected — teams should be aware of this behavioral drift.

fossa-action/tsconfig.json

Line 22 in 2273414

"strict": false /* Enable all strict type-checking options. */,

[11]: Official TypeScript 6.0 announcement documenting the types default change (empty array instead of all @​types/*), rootDir default change (tsconfig directory instead of inferred), and deprecation of --module amd/umd/system/none, --outFile, --moduleResolution classic/node10, --baseUrl, --downlevelIteration, target: es5, import assertions, esModuleInterop false, allowSyntheticDefaultImports false, and alwaysStrict false. (source link)

[12]: Official TypeScript 6.0 migration tracking issue confirming: (1) add "rootDir" explicitly if output files are unexpectedly nested, (2) add "types": ["node"] to restore Node.js global type resolution after the empty-array default change. (source link)

---

fossabot analyzed this PR using dependency research. View this analysis on the web

[dependabot]

Superseded by #296.