Upgrade to TypeScript ~6.0.3 #19
1
.github/workflows/claude-review.yaml
vendored
|
|
@ -7,6 +7,7 @@ on:
|
|||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
id-token: write
|
||||
|
|
||||
|
||||
jobs:
|
||||
review:
|
||||
|
|
|
|||
10
package-lock.json
generated
|
|
@ -18,11 +18,11 @@
|
|||
"@aws-sdk/client-dynamodb": "^3.1030.0",
|
||||
"@aws-sdk/lib-dynamodb": "^3.1041.0",
|
||||
"@types/aws-lambda": "^8.10.149",
|
||||
"@types/node": "^22.0.0",
|
||||
"@types/node": "^22.19.17",
|
||||
"aws-cdk": "^2.1120.0",
|
||||
"esbuild": "^0.25.0",
|
||||
"ts-node": "^10.9.2",
|
||||
"typescript": "~5.7.2"
|
||||
"typescript": "~6.0.3"
|
||||
}
|
||||
},
|
||||
"node_modules/@aws-cdk/asset-awscli-v1": {
|
||||
|
|
@ -2780,9 +2780,9 @@
|
|||
"license": "0BSD"
|
||||
},
|
||||
"node_modules/typescript": {
|
||||
"version": "5.7.3",
|
||||
"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.7.3.tgz",
|
||||
"integrity": "sha512-84MVSjMEHP+FQRPy3pX9sTVV/INIex71s9TL2Gm5FG/WG1SqXeKyZ0k7/blY/4FdOzI12CBy1vGc4og/eus0fw==",
|
||||
"version": "6.0.3",
|
||||
"resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
|
||||
"integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
|
||||
"dev": true,
|
||||
"license": "Apache-2.0",
|
||||
"bin": {
|
||||
|
|
|
|||
|
|
@ -14,11 +14,11 @@
|
|||
"@aws-sdk/client-dynamodb": "^3.1030.0",
|
||||
TypeScript version range changed from tilde to caretMedium Severity The Reviewed by Cursor Bugbot for commit ### TypeScript version range changed from tilde to caret
**Medium Severity**
<!-- DESCRIPTION START -->
The `typescript` version specifier changed from `~5.7.2` (patch-only updates) to `^6.0.3` (minor + patch updates). TypeScript explicitly does not follow semantic versioning — minor releases like 6.1 or 6.2 can introduce breaking type-checking changes. The previous `~` prefix was the safer, intentional choice. Using `^` risks future `npm install` runs pulling in a TypeScript minor release that breaks the build with new type errors.
<!-- DESCRIPTION END -->
<!-- BUGBOT_BUG_ID: 3aab6f02-d545-4dc0-9c30-6920bf1f93bc -->
<!-- LOCATIONS START
package.json#L20-L21
LOCATIONS END -->
<div><a href="https://cursor.com/open?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjJhNDU2OTMwLTMwZDktNGYxMC1hNjg5LWVkNTBhMTg1OGI1YiIsImVuY3J5cHRpb25LZXkiOiIzb3AtcnJJMnI5NDgzZm9TZDUzYmVtY2JQdTdzbGdsbGtNaWpQWTFodG5NIiwiYnJhbmNoIjoiZmVhdHVyZS90eXBlc2NyaXB0LTYtdXBncmFkZSIsInJlcG9Pd25lciI6IlNlYS1IYXZlbi1JbmR1c3RyaWVzIiwicmVwb05hbWUiOiJzZWFoYXZlbi1zbGFjay1ib3QifSwiaWF0IjoxNzc4MTA3NTU0LCJleHAiOjE3ODA2OTk1NTR9.KEwZ-ODjZCs153GpuO_vZaYT_0kz2GUHJgTiE3-aZLSs3oAbI-rpbOrGykkj26O5ALr4U8SSqFEBUkw5p5T1Re5s34GqN2ONfJjfhHaS-Fkh4ILAYC8wfUyM8FRq7Ui2Eltn0xzwNVBG_jOwN7bK_OMw9tSabx7KEbsBnrAC5TIuyJddTvq4f_Fi6Zg-0erysqMA6yhhdwJ6kVfuIvbVvmONpJOwYKG9uZqCF3lnHlPgF3WZGVE1Tm_c7O2mPDECCKeT25tUd_uhjTzNqYWPdoTmdJOla1uFP7Ip21CmbPVrnycNJ3hY0wOs3xplogGLChbiD6JTjl6j1HtK5jnKLg" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OjJhNDU2OTMwLTMwZDktNGYxMC1hNjg5LWVkNTBhMTg1OGI1YiIsImVuY3J5cHRpb25LZXkiOiIzb3AtcnJJMnI5NDgzZm9TZDUzYmVtY2JQdTdzbGdsbGtNaWpQWTFodG5NIiwiYnJhbmNoIjoiZmVhdHVyZS90eXBlc2NyaXB0LTYtdXBncmFkZSIsInJlcG9Pd25lciI6IlNlYS1IYXZlbi1JbmR1c3RyaWVzIiwicmVwb05hbWUiOiJzZWFoYXZlbi1zbGFjay1ib3QiLCJwck51bWJlciI6MTksImNvbW1pdFNoYSI6IjZkOWI4NzQyNTBhNTI4OTc5NmYwNTc4ODQ2YTU5YmUxN2E2NDUwOWMiLCJwcm92aWRlciI6ImdpdGh1YiJ9LCJpYXQiOjE3NzgxMDc1NTQsImV4cCI6MTc4MDY5OTU1NH0.MpTjg72CjqAN27Rb3vhENT2mE9NonmQau9J7adUxNbpjarGBAV9pJN1Ic0jMZ4eu9ovw4pvlmlMcfp2_ZOnrPaeZahcr9Ny2jcGziaLlocfhzZtMzW7rhoqkt7UuBmpKBkamF0S6nRtAfLBJ3w_I95kGcY0RQ00nVm2hrd7mj2iehrJSdQufzjGKm0YMsEw-5qTyLNcuyMfY7Cl_Lj4blJq7RoIKCshuqK2Qk1ilswCSfI2x0QdyhTHa4qwytcKV-BjoWRYCALbYDTOxTmJYjT7OIYmhP2i9lHPp4ByGD6qVjBKvWIQgQiOVAT-bB0tzqd0v4lRcxJP4Rg07kBGR1A" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div>
<sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6d9b874250a5289796f0578846a59be17a64509c. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
Node type definitions don't match Node.js 22 runtimeLow Severity
Reviewed by Cursor Bugbot for commit ### Node type definitions don't match Node.js 22 runtime
**Low Severity**
<!-- DESCRIPTION START -->
`@types/node` was bumped from `^22.0.0` to `^25.6.0`, but every Lambda function in the project uses `NODEJS_22_X` runtime and the Docker service uses `node:22-slim`. Previously the type definitions matched the runtime; now they describe Node.js 25 APIs that may not exist on the Node.js 22 runtime, creating a false sense of type safety and risking runtime errors if Node 25–only APIs are used.
<!-- DESCRIPTION END -->
<!-- BUGBOT_BUG_ID: ref1_e3eb794b-f9bf-4aca-b017-bd6b1b07d701 -->
<!-- LOCATIONS START
package.json#L16-L17
LOCATIONS END -->
<div><a href="https://cursor.com/open?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojg1ZjZkNDdmLWUzYWYtNDBhZS05ODA3LTM3NjIyNmNmMWZlNyIsImVuY3J5cHRpb25LZXkiOiJBMmpQMi00SllfUmx1dE5SdGRiZkRwZzQ1MGlkaWhNbTlNU3paRk0wOUNJIiwiYnJhbmNoIjoiZmVhdHVyZS90eXBlc2NyaXB0LTYtdXBncmFkZSIsInJlcG9Pd25lciI6IlNlYS1IYXZlbi1JbmR1c3RyaWVzIiwicmVwb05hbWUiOiJzZWFoYXZlbi1zbGFjay1ib3QifSwiaWF0IjoxNzc4MTA3NTU0LCJleHAiOjE3ODA2OTk1NTR9.MLaN6UV0PbzdkwqclHy7jLI2YUzI3nIwP4rYfVruD6iNz7zP_0YSXYSG7qCf_PbifASR_dwJqmqjViBv6R1xk8fnffjHlw6kFLMAWQZTVzxOJO7vNV9y4cYlmHXWbRS2YdCIEdXD_yv3ZMQ_dVyk6BboY-DbdLlmcI1bI_VpjUO5Xy4twg4H1AHDn5zuGVxu4J_lAfMJlgBChkX5bOqEPrSQ025A7A-k74WcAdDDZTMjgTpFbbKYKp6ANQfaVt_BA-3u_fyyu_lZbBveIXLrsU8BjsXoDkIJlbvPt54gDsVEvup8j5gWVqPJTgI2UGPJ5Y6z4spW-JjG2CtaWsudyQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90Ojg1ZjZkNDdmLWUzYWYtNDBhZS05ODA3LTM3NjIyNmNmMWZlNyIsImVuY3J5cHRpb25LZXkiOiJBMmpQMi00SllfUmx1dE5SdGRiZkRwZzQ1MGlkaWhNbTlNU3paRk0wOUNJIiwiYnJhbmNoIjoiZmVhdHVyZS90eXBlc2NyaXB0LTYtdXBncmFkZSIsInJlcG9Pd25lciI6IlNlYS1IYXZlbi1JbmR1c3RyaWVzIiwicmVwb05hbWUiOiJzZWFoYXZlbi1zbGFjay1ib3QiLCJwck51bWJlciI6MTksImNvbW1pdFNoYSI6IjZkOWI4NzQyNTBhNTI4OTc5NmYwNTc4ODQ2YTU5YmUxN2E2NDUwOWMiLCJwcm92aWRlciI6ImdpdGh1YiJ9LCJpYXQiOjE3NzgxMDc1NTQsImV4cCI6MTc4MDY5OTU1NH0.uSSji2DE3DbQTbQl2sxtzVotzp2iKTXRaPZj-GLuHGBjumEn5AKE7OaR8WPmslPpSA6ZSbNHSwOji879EupciJ9RZ39VL18UlierDuwFxVs89mWRMfsEgCMBqMK2ofYuyeEwrfjhRMs1u4hEc-27AFni3OH-9glKPkqB_xYSukUxoxG5Tr525PA39wTYiHpFXxFQGH4DeBsYrLyqUMzP0-O27GSYSlSdFBP1l5LwN18hcRLwxAvVS2AzppSOjdwX0SBTxj2G33-I-H3QLWApI272LGsZEG6Q_zRxLvX1fyS3niRMz2fJBdnRCGwN8CCSNqC9HEn6rAgszfqzSz7Ofg" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div>
<sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 6d9b874250a5289796f0578846a59be17a64509c. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
|
||||
"@aws-sdk/lib-dynamodb": "^3.1041.0",
|
||||
"@types/aws-lambda": "^8.10.149",
|
||||
"@types/node": "^22.0.0",
|
||||
"@types/node": "^22.19.17",
|
||||
"aws-cdk": "^2.1120.0",
|
||||
@types/node version specifier doesn't match intended upgradeLow Severity The PR title and description both state that Additional Locations (1)Reviewed by Cursor Bugbot for commit ### @types/node version specifier doesn't match intended upgrade
**Low Severity**
<!-- DESCRIPTION START -->
The PR title and description both state that `@types/node` is being bumped to 25.6.0, but the actual version specifier `^22.19.17` can only resolve within the 22.x range due to semver caret semantics. The lockfile confirms the resolved version is 22.19.17, not 25.6.0. If the intent was to upgrade to 25.x, the specifier needs to be `^25.6.0`.
<!-- DESCRIPTION END -->
<!-- BUGBOT_BUG_ID: ref1_52237570-441a-4c9d-bf37-deea0e519dc0 -->
<!-- LOCATIONS START
package.json#L16-L17
package-lock.json#L2069-L2070
LOCATIONS END -->
<details>
<summary>Additional Locations (1)</summary>
- [`package-lock.json#L2069-L2070`](https://github.com/Sea-Haven-Industries/seahaven-slack-bot/blob/3b84455692ef887eb1b48162635b7860fae95ec6/package-lock.json#L2069-L2070)
</details>
<div><a href="https://cursor.com/open?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmRjZjU0NDM5LWJjZDEtNGFlZi1iYmEyLWE4MjI0NGM0Y2U0YyIsImVuY3J5cHRpb25LZXkiOiJFYU1DY3ZmalVUbFhfaHZ1dnQxbWRnc01OQzlZTnMxQjZyOXctTGttUFAwIiwiYnJhbmNoIjoiZmVhdHVyZS90eXBlc2NyaXB0LTYtdXBncmFkZSIsInJlcG9Pd25lciI6IlNlYS1IYXZlbi1JbmR1c3RyaWVzIiwicmVwb05hbWUiOiJzZWFoYXZlbi1zbGFjay1ib3QifSwiaWF0IjoxNzc4MTA5MDQ4LCJleHAiOjE3ODA3MDEwNDh9.mCGXUwz9Ma4YGy2NUY3q5VmcU4e6M_ugt4vILsSiXcJxxiNeRnYhnkAw0ba4Yf6ZTIybmIL2JpD-e8RStacXavkodr5McXEe_1BoWXKrIJrNi2SSCcID4rvJIdxpHL13eOAl0bjmtzpjOkv28jIM2C3aeU38rrOjcQVW1G0npf8SF0-mCsdNGdFB8bgxtHv4gaJ6z28RHAuzvI7HXbiomk6-4h7Le8yAzQUmDglPGgwjugtbiAO5jeNYqg5IBYvN-t9fHeNn7ffASUttnVnWTRPJeLXQpdCM4z3M7dmjWiB8-3XR3J1e8GFQoRHU3INsbxy9F8MVBWyNFD_Qste7Cg" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?data=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImJ1Z2JvdC12MiJ9.eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmRjZjU0NDM5LWJjZDEtNGFlZi1iYmEyLWE4MjI0NGM0Y2U0YyIsImVuY3J5cHRpb25LZXkiOiJFYU1DY3ZmalVUbFhfaHZ1dnQxbWRnc01OQzlZTnMxQjZyOXctTGttUFAwIiwiYnJhbmNoIjoiZmVhdHVyZS90eXBlc2NyaXB0LTYtdXBncmFkZSIsInJlcG9Pd25lciI6IlNlYS1IYXZlbi1JbmR1c3RyaWVzIiwicmVwb05hbWUiOiJzZWFoYXZlbi1zbGFjay1ib3QiLCJwck51bWJlciI6MTksImNvbW1pdFNoYSI6IjNiODQ0NTU2OTJlZjg4N2ViMWI0ODE2MjYzNWI3ODYwZmFlOTVlYzYiLCJwcm92aWRlciI6ImdpdGh1YiJ9LCJpYXQiOjE3NzgxMDkwNDgsImV4cCI6MTc4MDcwMTA0OH0.X_7vxHMGTjsH8pJeTHwgiI7NczPWpxMOuLpW6wu15tqfR-m6OzYCYxzkpbHwSXT57t65rrHkC35pYLpkrY6A2L6oI82YYXYCAzKmn7kxW7hHeumO-kO5zCBwZbENe3WjGbU6gRShrpygchBY_ol-AgnbLl2GFEGJRDKJ4YG7_BF2iA2EeViArq1kM2EN3IN1VoySxva2joUvvbP3utqTmFTqQSUEgw41P266ARnQqS5cmlAg9znXIKdUQAnvM8drVoYwJDrFQfGx29uWmn9WQu6iMOOVPfyGMUNdiXUyVromU5XOUJjOykrNu1wdNOpQJhkIQcwVW6-FzBkfedgoRA" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div>
<sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 3b84455692ef887eb1b48162635b7860fae95ec6. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
|
||||
"esbuild": "^0.25.0",
|
||||
"ts-node": "^10.9.2",
|
||||
"typescript": "~5.7.2"
|
||||
"typescript": "~6.0.3"
|
||||
},
|
||||
"dependencies": {
|
||||
"@cdklabs/generative-ai-cdk-constructs": "^0.1.0",
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@
|
|||
"compilerOptions": {
|
||||
"target": "ES2020",
|
||||
"lib": ["ES2020"],
|
||||
"types": ["node"],
|
||||
"module": "commonjs",
|
||||
"declaration": true,
|
||||
"strict": true,
|
||||
|
|
|
|||
Unrelated
id-token: writepermission added to workflowMedium Severity
The
id-token: writepermission was added to the workflow but is not mentioned in the PR description and is unrelated to the TypeScript upgrade. This permission allows the workflow to mint OIDC tokens, which can be used to authenticate with cloud providers. Bundling a security-relevant permission escalation into an unrelated dependency-upgrade PR risks it going unreviewed.Reviewed by Cursor Bugbot for commit
4d492f6b3e. Configure here.