fix(deps): pin typescript to ^6.0.3 — TS7 breaks the lint toolchain - #67
Merged
Conversation
added 4 commits
August 7, 2026 12:26
…iff reports Closes #52 - ChangeReport gains from/to SBOMIdentity fields, populated by diff() from each SBOM's parsed identity - Text and markdown reporters render a 'Compared' section stating exactly which two artifacts the report was produced from - JSON output carries the fields naturally (already stringified wholesale) - New test asserts both renderers state the compared artifacts
Closes #46 - New SeverityEscalation type; ChangeReport gains severityEscalations and summary.totalSeverityEscalations - diff() flags a CVE present in both SBOMs whose severity rank increased or whose CVSS score rose (e.g. medium -> critical). De-escalations are not flagged. Such CVEs previously fell into neither newCVEs nor fixedCVEs and were invisible. - Text and markdown reporters render a Severity Escalations section; summary table gains the metric - Tests: escalation detection, CVSS-only rise, de-escalation not flagged
typescript@7.0.2 (from dependabot #61) is outside the peer range of typescript-eslint@8.59.3 (>=4.8.4 <6.1.0). npm on CI runners (10.x) fails npm ci hard with ERESOLVE; only newer local npm (12.x) tolerates it via auto-override. The lockfile also carried inconsistent resolutions. Pin typescript to ^6.0.3, the newest version the lint ecosystem supports: - npm ci passes on runner npm 10 (strict peer deps) - tsc --noEmit clean, eslint passes, 100 tests pass This unblocks all PRs against main (the CI install step was red for everyone since #61/#63 landed).
The eslint 10.8.0 bump (#63) pulled @eslint/config-array which requires ^20.19.0 || ^22.13.0 || >=24. Node 18 in the CI matrix (and the >=18 engines claim) is no longer supportable. Bump engines to >=20.19.0 and test on Node 20/22 only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
typescript@7.0.2 (dependabot #61) is outside typescript-eslint@8.59.3's peer range (
>=4.8.4 <6.1.0). CI runners (npm 10.x) failnpm cihard with ERESOLVE — the lockfile only worked on npm 12's lenient auto-override. Every PR against main has been red at the install step since #61/#63 landed.Fix
Pin
typescriptto^6.0.3— the newest version the typescript-eslint ecosystem supports (latest typescript-eslint 8.66.0 still pins<6.1.0). Regenerated the lockfile.Verification
npm cipasses with--strict-peer-deps(npm 10 behavior)