fix(renovate): ceiling typescript below v7 on an upstream block

Andrew Dunnrequested to merge
fix/typescript-upstream-ceiling into main

The finding

Renovate proposed typescript v7 across the estate's Astro projects. It fails CI in four (reference, serviceping-redact, bulkhead, egress) and cannot be fixed at the repository level.

v7 is the native-compiler port, and its package no longer exports the in-process compiler API. Anything that drives TypeScript programmatically breaks:

  • @astrojs/check at its latest published version (0.9.9) peers typescript: ^5.0.0 || ^6.0.0 — install fails ERESOLVE. There is no alpha or successor that admits v7.
  • Forcing it through with --legacy-peer-deps installs, then crashes @astrojs/language-server at runtime on the removed API. That is suppression, not a fix.
  • Dropping @astrojs/check works mechanically but silently deletes .astro frontmatter type coverage — a product trade-off, not a dependency chore.

Upstream tracks this at withastro/astro#17268, labelled triage: unable to fix: "TypeScript 7 does not currently support languages like Astro, Vue, Svelte. We cannot fix it until they do." Microsoft's own 7.0 announcement tells Astro/Vue/Svelte/MDX projects to stay on 6.x.

Why this is a ceiling and not a freeze

6.0.3 is stable and compatible with @astrojs/check's peer range. So this rule does not park these projects on 5.x — it makes Renovate propose the v6 major instead of a v7 that cannot merge. The estate moves forward a major version; it just moves to the major that exists for its stack.

It also stops four projects regenerating a red MR every day now that the cadence is daily.

Same idiom and same shape as the existing sigstore/cosign <3.0.0 rule: a specific upstream incompatibility, cited, with the removal condition stated. One line to delete when @astrojs/check ships v7 support.

A false green worth recording

crucible's typescript v7 MR passed CI. Its pipeline runs npm run build but never npm run check, and astro build does not load the typescript package — only astro check does. So the breakage was invisible and that MR looked mergeable.

A check script CI never runs is not a guarantee. Flagging rather than fixing here, since wiring it up is a change to that project, not to this preset — but it is worth a sweep for other projects with a declared script no pipeline invokes.

Two related traps

Both will appear as the same daily churn if they reach these projects, and they fail differently:

  • typescript-eslint carries a hard peer ceiling (typescript: >=4.8.4 <6.1.0) and fails loudly at install.
  • vue-tsc and svelte-check declare loose >=5.0.0 peers, so they install cleanly against v7 and fail at runtime — no CI signal at all.

Validation

renovate-config-validator --strict against renovate 43.272.0 (the version the runner executes) passes. This MR also exercises validate:renovate-config, which now fires on changes to this file.

🤖 Generated with Claude Code

Merge request reports