Update typescript to 6.0.3

[fossabot]

This PR catches up on 1 dependency update.

Why These Dependencies Were Grouped

Upgrade typescript from 5.9.3 to 6.0.3

Summary

The risk vs reward score of this upgrade is 156 (higher is better). View full report

Breaking	Security	Bug Fixes	Features	Deprecations
1	1	39	17	12

fossabot has not analyzed the impact of these changes on your codebase yet.

You can start an analysis with @fossabot analyze.

---

Package Updates (1)

• typescript: 5.9.3 → 6.0.3 (notes | diff)

---

fossabot created this PR

[fossabot]

[fossabot]

Needs Review

I recommend reviewing this upgrade before merging because it introduces two hard-breaking TypeScript 6 compilation failures that cause both the rebuild-dist and fossa-scan CI jobs to exit with code 1. TypeScript 6 changed two critical defaults simultaneously: rootDir no longer infers from source files (now requires explicit declaration), and types now defaults to an empty array (meaning @​types/node is no longer auto-discovered). The project's tsconfig.json has both settings commented out, and the source files (download-cli.ts and index.ts) make heavy use of Node.js globals (process, Buffer, node:fs) that are now unresolvable. Fortunately, the fixes are mechanical and well-scoped: uncomment and set "rootDir": "./src" in tsconfig.json, and add "types": ["node"] to compilerOptions — @​types/node is already present as a dev dependency in package.json. Beyond these blockers, 11 deprecation warnings signal that several legacy tsconfig options (strict: false, allowSyntheticDefaultImports, moduleResolution: NodeNext comment style, etc.) may require attention in a follow-up. Once the two tsconfig fixes are applied, the upgrade should proceed cleanly given the project's already-modern module setup.

Tip: Comment @​fossabot fix to attempt automatic fixes.

Fix Suggestions

We identified 2 fixable issues in this upgrade.

• In tsconfig.json, uncomment and set "rootDir" to "./src". Find the line // "rootDir": "./", (around line 15) and replace it with "rootDir": "./src",. TypeScript 6 no longer infers rootDir from source file locations and now requires it to be explicitly set (TS5011).
  Files: tsconfig.json
• In tsconfig.json, uncomment and set the "types" array to include "node". Find the line // "types": [], (around line 43) and replace it with "types": ["node"],. TypeScript 6 changed the default for types from auto-discovering all @​types/* packages to an empty array, so @​types/node must be explicitly listed. The @​types/node package is already installed as a devDependency — no npm/yarn install is needed.
  Files: tsconfig.json

AI Assistant Prompt

Copy prompt for AI assistant

# Fix TypeScript 6.0.3 Upgrade Breaking Changes

## Context
This project (a GitHub Action) has been upgraded from TypeScript 5.9.3 to 6.0.3. The upgrade causes two hard CI failures in `yarn build` (affecting both `rebuild-dist` and `fossa-scan` jobs). Both failures are caused by missing settings in `tsconfig.json` due to TypeScript 6 changing two critical defaults.

## Errors
1. **TS5011** — `rootDir` is no longer inferred from source files; it now defaults to the `tsconfig.json` directory and must be explicitly set.
2. **TS2591** — `types` now defaults to `[]` (empty array) instead of auto-discovering all `@​types/*` packages. This means `@​types/node` is no longer picked up, so Node.js globals (`process`, `Buffer`, `node:fs`) are unresolved in `src/download-cli.ts` and `src/index.ts`.

## Required Fixes (in `tsconfig.json`)

### Fix 1: Set `rootDir` explicitly
Find the commented-out line (around line 15):
```
// "rootDir": "./",
```
Replace it with:
```
"rootDir": "./src",
```

### Fix 2: Add `"node"` to the `types` array
Find the commented-out line (around line 43):
```
// "types": [],
```
Replace it with:
```
"types": ["node"],
```

**Note:** `@​types/node` is already listed as a `devDependency` in `package.json`, so no install is needed.

## Verification
After making both changes, run `yarn build` to confirm the project compiles without errors.

What we checked

• rootDir is commented out: // "rootDir": "./",. TypeScript 6 removed the implicit inference of rootDir from source file locations and now requires it to be explicitly set, emitting TS5011 when absent. The value must be set to "./src" to match the project's source layout and prevent the dist output from gaining an extra src/ nesting level. ^[1]
• types is commented out: // "types": [],. TypeScript 6 changed the default for types from auto-discovering all @​types/* packages to an empty array []. This means @​types/node is no longer resolved automatically, causing TS2591 errors for every use of Node.js globals (process, Buffer, node:fs). Fix: add "types": ["node"] to compilerOptions. ^[2]
• @​types/node is already present as a dev dependency ("@​types/node": "^24.12.2"), so no npm install step is required — only the tsconfig.json types array needs to be activated. ^[3]
• The upgrade target is declared as "typescript": "^6.0.3" in devDependencies, confirming the new major version is actively in use during the CI build via ncc build src/index.ts. ^[4]
• import * as fs from 'node:fs' — uses Node.js node: protocol import. Without "types": ["node"] in tsconfig.json, TypeScript 6 cannot resolve this, yielding TS2591: Cannot find name 'node:fs'. ^[5]
• process.platform — uses Node.js global process. Without @​types/node being explicitly typed, TypeScript 6 emits TS2591: Cannot find name 'process'. ^[6]
• (data: Buffer) — uses Node.js global Buffer type. Without @​types/node in the types array, TypeScript 6 emits TS2591: Cannot find name 'Buffer'. ^[7]
• (data: Buffer) in collectOutput callback — same Buffer global usage repeated. Affected by the same TS2591 error as in download-cli.ts. ^[8]
• const PATH = process.env.PATH || '' — uses Node.js global process.env. Without @​types/node in scope, TypeScript 6 emits TS2591: Cannot find name 'process'. ^[9]
• "strict": false is explicitly set. TypeScript 6 changes the default to strict: true, but since this project has an explicit false, it will not suddenly enable strict null-checks — no cascade of new type errors is expected from this default change. ^[10]
• Official TypeScript 6 migration issue documents that types now defaults to [] (requiring explicit 'node' entry) and rootDir now defaults to the tsconfig directory rather than being inferred from sources — the exact two defaults that break this project's build. ^[11]
• TypeScript 6.0 official announcement confirms nine simultaneous default changes including types: [] and changed rootDir behavior, along with removal of legacy module formats. The project's use of module: NodeNext and moduleResolution: NodeNext avoids the removed AMD/UMD/SystemJS and classic/node10 module resolution modes. ^[12]
• Documents the exact build failure pattern seen in this project's CI: 'Cannot find name process/fs' errors and unexpected output nesting caused by the changed rootDir default — both directly applicable to this codebase. ^[13]

Dependency Usage

typescript is a foundational developer tooling dependency for this project — the entire source codebase (src/config.ts, src/download-cli.ts, src/index.ts) is authored in TypeScript and compiled to JavaScript via the ncc build script for distribution. As a devDependency, it is never imported directly at runtime; instead, it operates as the compiler that powers static type-checking and transpilation, with tsconfig.json configuring the build and @​typescript-eslint plugins enforcing code quality standards. This setup is a standard, mature pattern for GitHub Actions authored in Node.js, ensuring type safety across the action's core logic without adding any runtime overhead.

• import * as fs from 'node:fs' — uses Node.js node: protocol import. Without "types": ["node"] in tsconfig.json, TypeScript 6 cannot resolve this, yielding TS2591: Cannot find name 'node:fs'.
  

  fossa-action/src/download-cli.ts

  Line 4 in fab1755

  import * as fs from 'node:fs';

• process.platform — uses Node.js global process. Without @​types/node being explicitly typed, TypeScript 6 emits TS2591: Cannot find name 'process'.
  

  fossa-action/src/download-cli.ts

  Line 10 in fab1755

  switch (process.platform) {

View 3 more usages

• (data: Buffer) — uses Node.js global Buffer type. Without @​types/node in the types array, TypeScript 6 emits TS2591: Cannot find name 'Buffer'.
  

  fossa-action/src/download-cli.ts

  Line 89 in fab1755

  stdout: (data: Buffer) => {

• (data: Buffer) in collectOutput callback — same Buffer global usage repeated. Affected by the same TS2591 error as in download-cli.ts.
  

  fossa-action/src/index.ts

  Line 63 in fab1755

  const collectOutput = (data: Buffer) => {

• const PATH = process.env.PATH || '' — uses Node.js global process.env. Without @​types/node in scope, TypeScript 6 emits TS2591: Cannot find name 'process'.
  

  fossa-action/src/index.ts

  Line 73 in fab1755

  const PATH = process.env.PATH || '';

Changes

typescript has been upgraded to its latest beta/release, bringing 44 bug fixes including crashes in declaration emit, mixin checking, abstract property checking, and control flow analysis, alongside 11 notable deprecations of legacy compiler options including --outFile, --downlevelIteration, --module amd/umd/system, --moduleResolution classic/node10, esModuleInterop, baseUrl, and alwaysStrict: false. Developers should audit their tsconfig.json for deprecated options, and note that --strict now defaults to true and noUncheckedSideEffectImports is enabled by default.

• Deprecate assert in import() (v5.9.3-6.0.2, commit)
• Deprecate downlevelIteration (v5.9.3-6.0.2, commit)
• Deprecate alwaysStrict: false (v5.9.3-6.0.2, commit)

View 174 more changes

• fixed issues query for TypeScript 6.0.0 (Beta). (v5.9.3-6.0.2, release notes)
• fixed issues query for TypeScript 6.0.0 (Beta). (v6.0.2-6.0.3, release notes)
• npm (v5.9.3-6.0.2, release notes)
• npm (v6.0.2-6.0.3, release notes)
• Fix missing lib files in reused projects (v5.9.3-6.0.2, commit)
• Port anyFunctionType subtype fix to release-6.0 (v5.9.3-6.0.2, commit)
• Fix crash in declaration emit with nested binding patterns (v5.9.3-6.0.2, commit)
• Fix from and with method types of Temporal.PlainMonthDay (v5.9.3-6.0.2, commit)
• Un-consolidate and fix WeakMap constructor overloads (v5.9.3-6.0.2, commit)
• Fix RegExpIndicesArray by adding undefined to type definition (v5.9.3-6.0.2, commit)
• Fix JSX source location when react-jsx with whitespace before JSX (v5.9.3-6.0.2, commit)
• Fix tests that should have stayed ES5 (v5.9.3-6.0.2, commit)
• Fix crash caused by circularly-reentrant getEffectsSignature (v5.9.3-6.0.2, commit)
• Eliminate tests/lib/lib.d.ts and fix fourslash to use real libs (v5.9.3-6.0.2, commit)
• Fix synthetic default export eligibility by consulting referenced project options (v5.9.3-6.0.2, commit)
• Fix transform crash with destructured parameter property (v5.9.3-6.0.2, commit)
• More test suite strictness fixups (v5.9.3-6.0.2, commit)
• Fix typo in JSDoc of Math.trunc(…) (v5.9.3-6.0.2, commit)
• Fix crash related to index type deferral on generic mapped types with named tuples (v5.9.3-6.0.2, commit)
• Correctly split line endings for // @​testOption: value parsing (v5.9.3-6.0.2, commit)
• Fix "never nullish" diagnostic missing expressions wrapped in parentheses (v5.9.3-6.0.2, commit)
• Fix spurious "used before being assigned" errors in for-of loops (v5.9.3-6.0.2, commit)
• Fix crash in abstract property checking (v5.9.3-6.0.2, commit)
• Fix crash in mixin checking (v5.9.3-6.0.2, commit)
• Fix crash when adding unreachable code diagnostic with missing nodes (v5.9.3-6.0.2, commit)
• Fix typo: MERCHANTABLITY → MERCHANTABILITY (v5.9.3-6.0.2, commit)
• Fix accidental module replacements in tests (v5.9.3-6.0.2, commit)
• ES2020: fix String.prototype.matchAll type and description (v5.9.3-6.0.2, commit)
• Fix ContextFlags compile error (v5.9.3-6.0.2, commit)
• Widen reverse mapped type properties to fix EPC-valid treatment (v5.9.3-6.0.2, commit)
• Fix unreachable code detection persisting after incremental edits (v5.9.3-6.0.2, commit)
• Fixed control flow analysis of aliased discriminants with parenthesized initializers (v5.9.3-6.0.2, commit)
• Fix [Symbol.iterator]() lost on union with never (v5.9.3-6.0.2, commit)
• Fixed issue with "slow" sync iteration types spoiling cached value (v5.9.3-6.0.2, commit)
• Fix TS2783 false positive for union types in object spread expressions (v5.9.3-6.0.2, commit)
• Fixed crash when parsing invalid decorator on await expression (v5.9.3-6.0.2, commit)
• Fix discriminant property selection order-independence in unions (v5.9.3-6.0.2, commit)
• Consistently resolve to errorType on arguments with error (v5.9.3-6.0.2, commit)
• Fix error message TS1355 (v5.9.3-6.0.2, commit)
• Fix incorrectly ignored dts file from project reference for resolution (v5.9.3-6.0.2, commit)
• Fix parenthesizer rules for manually constructed binary expressions with ?? (v5.9.3-6.0.2, commit)
• Fix private identifier fields generating errors in class expression declarations (v5.9.3-6.0.2, commit)
• Fix fourslash tests (v5.9.3-6.0.2, commit)
• Fix releaser tag creation (v5.9.3-6.0.2, commit)
• Fix incorrect test options (v5.9.3-6.0.2, commit)
• Add format to update baselines/fix lints task (v5.9.3-6.0.2, commit)
• Deprecate import assert in favor of import with (v5.9.3-6.0.2, commit)
• Default target to "latest standard" and deprecate ES5 (v5.9.3-6.0.2, commit)
• Deprecate --outFile (v5.9.3-6.0.2, commit)
• Deprecate module syntax (v5.9.3-6.0.2, commit)
• Deprecate --module amd, umd, system, none; --moduleResolution classic (v5.9.3-6.0.2, commit)
• Deprecate esModuleInterop and allowSyntheticDefaultImports (default to true) (v5.9.3-6.0.2, commit)
• Deprecate baseUrl (v5.9.3-6.0.2, commit)
• Deprecate --moduleResolution node10 (v5.9.3-6.0.2, commit)
• Add symbol name to error message for TS2742 (v5.9.3-6.0.2, commit)
• Add lib.esnext.temporal (v5.9.3-6.0.2, commit)
• Add approximatelySign to NumberFormatRangePartTypeRegistry for ES2023 (v5.9.3-6.0.2, commit)
• Implement Intl Locale Info proposal (v5.9.3-6.0.2, commit)
• Add proposal-upsert methods to lib.esnext.collection (v5.9.3-6.0.2, commit)
• Add --stableTypeOrdering for TS7 ordering compat (v5.9.3-6.0.2, commit)
• Add collation to Intl.CollatorOptions (v5.9.3-6.0.2, commit)
• Introduce ES2025 target and Add missing ScriptTargetFeatures (v5.9.3-6.0.2, commit)
• Add note about PRs to CONTRIBUTING.md (v5.9.3-6.0.2, commit)
• Add tests for contextual param type assignment in nested return type inference (v5.9.3-6.0.2, commit)
• Add --ignoreConfig flag and disallow specifying files on command line without it (v5.9.3-6.0.2, commit)
• Add missing whitespace after type parameter modifiers in interactive inlay hints (v5.9.3-6.0.2, commit)
• Add allowJs default value description (v5.9.3-6.0.2, commit)
• Add type definitions for Uint8Array to/from base64 methods (v5.9.3-6.0.2, commit)
• Add missing Float16Array constructors (v5.9.3-6.0.2, commit)
• Add john favret to pr_owners.txt (v5.9.3-6.0.2, commit)
• Bump version to 6.0.2 and LKG (v5.9.3-6.0.2, commit)
• Bump version to 6.0.1-rc and LKG (v5.9.3-6.0.2, commit)
• Update LKG (v5.9.3-6.0.2, commit)
• Merge remote-tracking branch 'origin/main' into release-6.0 (v5.9.3-6.0.2, commit)
• Update dependencies (v5.9.3-6.0.2, commit)
• Bump github-actions group with multiple updates (v5.9.3-6.0.2, commit)
• Update DOM types (v5.9.3-6.0.2, commit)
• Discrete pluralizer for lib.esnext.temporal unit unions (v5.9.3-6.0.2, commit)
• Eliminate interpolation from workflows (v5.9.3-6.0.2, commit)
• Ensure node is installed in release publisher (v5.9.3-6.0.2, commit)
• Bump version to 6.0.0-beta and LKG (v5.9.3-6.0.2, commit)
• Always set up host in node builder (v5.9.3-6.0.2, commit)
• Document indexOf return value when not found (v5.9.3-6.0.2, commit)
• Return iterable of RegExpExecArray from RegExp#[Symbol.matchAll] (v5.9.3-6.0.2, commit)
• Update Map.clear and Set.clear jsdoc in es2015.collection.d.ts (v5.9.3-6.0.2, commit)
• Set default types array to [] and support "*" wildcard (v5.9.3-6.0.2, commit)
• Update descriptions for strict-related flags (v5.9.3-6.0.2, commit)
• Disable macOS in PR CI (v5.9.3-6.0.2, commit)
• Switch default of --strict to true (v5.9.3-6.0.2, commit)
• Hide omitted expression types in type baselines (v5.9.3-6.0.2, commit)
• Remove ES5 references and misc cleanup (v5.9.3-6.0.2, commit)
• Update implied default for module based on target (v5.9.3-6.0.2, commit)
• Be more lenient about iteration when lib=es5 / noLib (v5.9.3-6.0.2, commit)
• Remove compiler runner libFiles option (v5.9.3-6.0.2, commit)
• Support FORCE_COLOR (v5.9.3-6.0.2, commit)
• Turn // @​strict off in failing fourslash tests without baseline (v5.9.3-6.0.2, commit)
• Explicitly set strict: false for project tests and eval tests (v5.9.3-6.0.2, commit)

View 77 more changes in the full analysis

References (13)

[1]: rootDir is commented out: // "rootDir": "./",. TypeScript 6 removed the implicit inference of rootDir from source file locations and now requires it to be explicitly set, emitting TS5011 when absent. The value must be set to "./src" to match the project's source layout and prevent the dist output from gaining an extra src/ nesting level.

fossa-action/tsconfig.json

Line 15 in fab1755

// "rootDir": "./", /* Specify the root directory of input files. Use to control the output directory structure with --outDir. */

[2]: types is commented out: // "types": [],. TypeScript 6 changed the default for types from auto-discovering all @​types/* packages to an empty array []. This means @​types/node is no longer resolved automatically, causing TS2591 errors for every use of Node.js globals (process, Buffer, node:fs). Fix: add "types": ["node"] to compilerOptions.

fossa-action/tsconfig.json

Line 43 in fab1755

// "types": [], /* Type declaration files to be included in compilation. */

[3]: @​types/node is already present as a dev dependency ("@​types/node": "^24.12.2"), so no npm install step is required — only the tsconfig.json types array needs to be activated.

fossa-action/package.json

Line 23 in fab1755

"@types/node": "^24.12.2",

[4]: The upgrade target is declared as "typescript": "^6.0.3" in devDependencies, confirming the new major version is actively in use during the CI build via ncc build src/index.ts.

fossa-action/package.json

Line 37 in fab1755

"typescript": "^6.0.3"

[5]: import * as fs from 'node:fs' — uses Node.js node: protocol import. Without "types": ["node"] in tsconfig.json, TypeScript 6 cannot resolve this, yielding TS2591: Cannot find name 'node:fs'.

fossa-action/src/download-cli.ts

Line 4 in fab1755

import * as fs from 'node:fs';

[6]: process.platform — uses Node.js global process. Without @​types/node being explicitly typed, TypeScript 6 emits TS2591: Cannot find name 'process'.

fossa-action/src/download-cli.ts

Line 10 in fab1755

switch (process.platform) {

[7]: (data: Buffer) — uses Node.js global Buffer type. Without @​types/node in the types array, TypeScript 6 emits TS2591: Cannot find name 'Buffer'.

fossa-action/src/download-cli.ts

Line 89 in fab1755

stdout: (data: Buffer) => {

[8]: (data: Buffer) in collectOutput callback — same Buffer global usage repeated. Affected by the same TS2591 error as in download-cli.ts.

fossa-action/src/index.ts

Line 63 in fab1755

const collectOutput = (data: Buffer) => {

[9]: const PATH = process.env.PATH || '' — uses Node.js global process.env. Without @​types/node in scope, TypeScript 6 emits TS2591: Cannot find name 'process'.

fossa-action/src/index.ts

Line 73 in fab1755

const PATH = process.env.PATH || '';

[10]: "strict": false is explicitly set. TypeScript 6 changes the default to strict: true, but since this project has an explicit false, it will not suddenly enable strict null-checks — no cascade of new type errors is expected from this default change.

fossa-action/tsconfig.json

Line 22 in fab1755

"strict": false /* Enable all strict type-checking options. */,

[11]: Official TypeScript 6 migration issue documents that types now defaults to [] (requiring explicit 'node' entry) and rootDir now defaults to the tsconfig directory rather than being inferred from sources — the exact two defaults that break this project's build. (source link)

[12]: TypeScript 6.0 official announcement confirms nine simultaneous default changes including types: [] and changed rootDir behavior, along with removal of legacy module formats. The project's use of module: NodeNext and moduleResolution: NodeNext avoids the removed AMD/UMD/SystemJS and classic/node10 module resolution modes. (source link)

[13]: Documents the exact build failure pattern seen in this project's CI: 'Cannot find name process/fs' errors and unexpected output nesting caused by the changed rootDir default — both directly applicable to this codebase. (source link)

---

fossabot analyzed this PR using dependency research. View this analysis on the web