chore(deps): bump typescript from 6.0.3 to 7.0.2 by dependabot[bot] · Pull Request #1038 · copse-dev/agent-pane

dependabot · 2026-07-20T08:09:18Z

Bumps typescript from 6.0.3 to 7.0.2.

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

## Summary Dependabot's weekly `npm_and_yarn` update on tip `ebb98405` (run [29726768135](https://github.com/copse-dev/agent-pane/actions/runs/29726768135)) failed with: ``` dompurify | dependency_file_not_resolvable Override for dompurify@3.4.12 conflicts with direct dependency. ``` Product CI was not red — only the Dependabot check suite. Dependabot still opened the unrelated TypeScript bump (#1038). ## Cause `package.json` listed `dompurify` as both a direct dependency and a literal `overrides` entry (`^3.4.11`). Dependabot bumps one side first; npm then rejects the lockfile update with `EOVERRIDE` because the override no longer matches the direct spec. The override is still needed so mermaid/monaco's older nested `dompurify` pins stay on the patched release. ## Fix - Change `overrides.dompurify` to npm's `$dompurify` reference (tracks the direct dep). - Bump the direct dependency to `^3.4.12` and refresh the lockfile. ## Validation - Reproduced old path: `npm install dompurify@3.4.12 --force --package-lock-only` → `EOVERRIDE`. - Same command with `$dompurify` → exit 0. - `npm audit --audit-level=high` → 0 vulnerabilities. - `npm run check` → pass (3574 tests). - Confirmed no existing open PR for this conflict (only Dependabot #1038 for typescript). ## Test plan - [x] Local `npm run check` - [x] Local Dependabot-style install dry-run / force lock update - [ ] CI on this PR - [ ] Next Dependabot npm update no longer fails on `dompurify` <div><a href="https://cursor.com/agents/bc-af7585e6-216f-42e7-9f70-0eb944debec0"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a href="https://cursor.com/automations/62eac492-810a-11f1-ba66-0e7d0216e441"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/view-automation-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/view-automation-light.png"><img alt="View Automation" width="141" height="28" src="https://cursor.com/assets/images/view-automation-dark.png"></picture></a> </div> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Jonathan Kingston <jonathanKingston@users.noreply.github.com>

cursor

Stale comment

PR health — converted back to draft

CI: precheck/autoformat fail with ERESOLVE: typescript-eslint@8.63.0 peers typescript@">=4.8.4 <6.1.0", but this bump installs typescript@7.0.2.

Not safe to auto-merge as a lone Dependabot bump — needs a coordinated typescript-eslint (or override) upgrade that supports TS 7, plus a typecheck pass.

Converted to draft and cleared auto-merge intent. cc @jonathanKingston for whether to pursue a TS 7 + eslint toolchain bump or close until upstream peer range opens.

_{Sent by Cursor Automation: Check in with agent-pane prs}

cursor

Stale comment

PR health — still blocked (leave draft)

Dependabot TypeScript 6.0.3 → 7.0.2 remains unsafe alone: typescript-eslint peers still require typescript@">=4.8.4 <6.1.0", so precheck/autoformat fail with ERESOLVE.

No auto-merge. Needs a coordinated eslint/typescript-eslint upgrade (or wait for ecosystem TS 7 support). Leaving draft.

_{Sent by Cursor Automation: Check in with agent-pane prs}

cursor

Stale comment

PR health — leave draft

Still blocked on ERESOLVE: typescript-eslint peers do not accept TypeScript 7. Not safe as a lone Dependabot bump; needs a coordinated eslint/TS upgrade. No rebase or auto-merge.

_{Sent by Cursor Automation: Check in with agent-pane prs}

cursor

Stale comment

PR health — leave draft

No change since the last pass: precheck/autoformat still fail with ERESOLVE because typescript-eslint@8.63.0 peers typescript@">=4.8.4 <6.1.0" while this bump installs typescript@7.0.2.

Not safe to auto-merge as a lone Dependabot bump. Needs a coordinated typescript-eslint (or wait-for-ecosystem) upgrade. Leaving draft; no rebase/retrigger.

_{Sent by Cursor Automation: Check in with agent-pane prs}

cursor

Stale comment

PR health — leave draft

No change since the last pass: Dependabot TypeScript 6.0.3 → 7.0.2 still fails precheck/autoformat on ERESOLVE — typescript-eslint peers do not accept TypeScript 7.

Not safe as a lone Dependabot bump. Leave draft; needs a coordinated eslint/typescript-eslint upgrade (or upstream peer range) before retry.

@jonathanKingston — flagging only if you want this unblocked soon; otherwise fine to keep parked.

_{Sent by Cursor Automation: Check in with agent-pane prs}

cursor

Stale comment

PR health — leave draft

No change since the last pass: Dependabot TypeScript 7.0.2 is still blocked by typescript-eslint peer ERESOLVE. Not safe as a lone lockfile bump — leave draft until the eslint toolchain can accept TS 7.

View PR

_{Sent by Cursor Automation: Check in with agent-pane prs}

cursor

Stale comment

PR health — leave draft

TypeScript 7 bump is still blocked on typescript-eslint peer compatibility (precheck / autoformat fail as before). Leaving draft; no safe auto-merge path until the eslint stack catches up.

View PR

_{Sent by Cursor Automation: Check in with agent-pane prs}

github-actions · 2026-07-22T01:27:43Z

Merge conflict needs a human

develop advanced and screenshot conflicts were resolved automatically, but these non-screenshot files conflict and can't be auto-merged. Resolve them by hand (merge or rebase develop):

package-lock.json
package.json

cursor

PR health — leave draft

Tip 08f5d287 is still the Dependabot TypeScript 6.0.3 → 7.0.2 bump. It remains DIRTY vs main (package.json / package-lock.json) and tip CI is red on precheck / autoformat from the same typescript-eslint peer ERESOLVE (typescript: ">=4.8.4 <6.1.0").

Not safe to rebase or auto-merge as a lone lockfile bump — leave draft until the eslint toolchain can accept TS 7. Not retriggering CI.

_{Sent by Cursor Automation: Check in with agent-pane prs}

jonathanKingston · 2026-07-24T18:21:22Z

·@·d·ependabot r·ecreate

This branch is 52 commits behind main and conflicts, so a plain rebase won't clear it — recreating it against current main is the cleaner path. Flagging separately that this is a major bump (TypeScript 6 → 7) and worth a deliberate look rather than a routine merge.

Generated by Claude Code

jonathanKingston · 2026-07-26T17:23:18Z

@dependabot recreate

Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

jonathanKingston · 2026-07-26T19:10:17Z

Closing as currently unmergeable: TypeScript 7.0.2 conflicts with typescript-eslint 8.63.0, whose peer range is >=4.8.4 <6.1.0. CI fails during npm ci with ERESOLVE before tests can start. Reopen/update once the lint toolchain officially supports TypeScript 7; forcing or using legacy peer resolution would leave CI on an unsupported combination.

dependabot · 2026-07-26T19:10:20Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

dependabot Bot added the dependencies label Jul 20, 2026

jonathanKingston added this to the Post-GA product work milestone Jul 20, 2026

jonathanKingston enabled auto-merge (squash) July 20, 2026 08:12

cursor Bot mentioned this pull request Jul 20, 2026

fix(deps): use $dompurify override so Dependabot can bump it #1039

Merged

4 tasks

jonathanKingston force-pushed the dependabot/npm_and_yarn/typescript-7.0.2 branch from da9186c to 08f5d28 Compare July 20, 2026 11:13

cursor Bot marked this pull request as draft July 20, 2026 14:46

auto-merge was automatically disabled July 20, 2026 14:46
Pull request was converted to draft

cursor Bot reviewed Jul 20, 2026

View reviewed changes

cursor Bot reviewed Jul 21, 2026

View reviewed changes

cursor Bot reviewed Jul 22, 2026

View reviewed changes

dependabot Bot changed the base branch from main to develop July 26, 2026 13:38

dependabot Bot force-pushed the dependabot/npm_and_yarn/typescript-7.0.2 branch from 08f5d28 to 17553bb Compare July 26, 2026 17:24

jonathanKingston marked this pull request as ready for review July 26, 2026 17:53

Merge branch 'develop' into dependabot/npm_and_yarn/typescript-7.0.2

41906c4

jonathanKingston enabled auto-merge (squash) July 26, 2026 17:53

jonathanKingston closed this Jul 26, 2026

auto-merge was automatically disabled July 26, 2026 19:10
Pull request was closed

dependabot Bot deleted the dependabot/npm_and_yarn/typescript-7.0.2 branch July 26, 2026 19:10

Navigation Menu

chore(deps): bump typescript from 6.0.3 to 7.0.2 - #1038

chore(deps): bump typescript from 6.0.3 to 7.0.2#1038
dependabot[bot] wants to merge 2 commits into
developfrom
dependabot/npm_and_yarn/typescript-7.0.2

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

github-actions Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

jonathanKingston commented Jul 24, 2026

Uh oh!

jonathanKingston commented Jul 26, 2026

Uh oh!

jonathanKingston commented Jul 26, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

PR health — converted back to draft

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

PR health — still blocked (leave draft)

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

PR health — leave draft

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

PR health — leave draft

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

PR health — leave draft

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

PR health — leave draft

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

PR health — leave draft

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge conflict needs a human

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

PR health — leave draft

Uh oh!

jonathanKingston commented Jul 24, 2026

Uh oh!

jonathanKingston commented Jul 26, 2026

Uh oh!

jonathanKingston commented Jul 26, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

cursor Bot left a comment •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading