Skip to content

chore(deps): align TypeScript on 6.0.3 - #6607

Merged
cv merged 1 commit into
mainfrom
codex/upgrade-typescript-6-0-3
Jul 9, 2026
Merged

chore(deps): align TypeScript on 6.0.3#6607
cv merged 1 commit into
mainfrom
codex/upgrade-typescript-6-0-3

Conversation

@cv

@cv cv commented Jul 9, 2026

Copy link
Copy Markdown
Collaborator

Summary

Aligns every direct TypeScript compiler dependency on 6.0.3, the newest stable release that retains the compiler APIs used by NemoClaw's repository checks and test loaders. This removes the split between TypeScript 5.9 and 6.0 without introducing a second compatibility package.

Changes

  • Pin the root, plugin, and weather E2E fixture TypeScript dependencies and lockfiles to exact version 6.0.3.
  • Add the plugin's explicit Node type set required by TypeScript 6 defaults.
  • Revalidate the weather fixture dependency audit and update its checked-in lockfile digest.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification: compiler-API loading, source transpilation, plugin compilation, and the fixture lock-review contract already have dedicated coverage; the focused four-file integration run passed 130 tests.
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: this is an internal development-tooling alignment with no CLI or runtime behavior change; the required fixture dependency-review date and digest were refreshed, and npm run docs completed with 0 errors and 2 warnings.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: reran npm audit --package-lock-only --ignore-scripts --json; the reviewed release-pinned fixture graph remains at 9 known vulnerabilities (3 moderate, 6 high), the advisory set is unchanged, and the lock-digest enforcement test passed.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

  • PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npx vitest run --project integration test/inference-options-docs.test.ts test/nemoclaw-start.test.ts test/source-require-loader.test.ts test/e2e-fixture-dependency-review.test.ts — 130 passed.
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: npm test recorded 15,568 passes and its sole inherited-SSH assertion passed on an environment-clean rerun; the npm run check structural/plugin gates passed and the SSH-clean CLI coverage retry passed 13,742 tests with the coverage ratchet satisfied.
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

  • Chores

    • Updated TypeScript to version 6.0.3 across the project and related test fixtures.
    • Added Node.js type definitions to the TypeScript configuration for more accurate type checking.
  • Documentation

    • Refreshed the security review record with the latest review date and audit results.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@cv cv self-assigned this Jul 9, 2026
@coderabbitai

coderabbitai Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: da8f9e32-b6c2-43b3-a8f4-b0d542695c94

📥 Commits

Reviewing files that changed from the base of the PR and between 614122b and e45a8bb.

⛔ Files ignored due to path filters (3)
  • nemoclaw/package-lock.json is excluded by !**/package-lock.json
  • package-lock.json is excluded by !**/package-lock.json
  • test/e2e/fixtures/plugins/weather/package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (5)
  • docs/security/e2e-weather-plugin-fixture-dependency-review.md
  • nemoclaw/package.json
  • nemoclaw/tsconfig.json
  • package.json
  • test/e2e/fixtures/plugins/weather/package.json

📝 Walkthrough

Walkthrough

Updates TypeScript to 6.0.3 across project tooling and the weather fixture, adds Node.js types to nemoclaw, and refreshes the weather fixture dependency audit date and lockfile hash.

Changes

TypeScript tooling alignment

Layer / File(s) Summary
TypeScript versions and compiler types
package.json, nemoclaw/package.json, nemoclaw/tsconfig.json, test/e2e/fixtures/plugins/weather/package.json
TypeScript development dependencies are aligned to 6.0.3, and nemoclaw explicitly includes Node.js types.

Security audit refresh

Layer / File(s) Summary
Dependency review record
docs/security/e2e-weather-plugin-fixture-dependency-review.md
The review date and advisory audit revalidation output are updated for 2026-07-09, including the reviewed lockfile SHA-256.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

Suggested labels: chore

Suggested reviewers: kjw3

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: aligning TypeScript dependencies to 6.0.3.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/upgrade-typescript-6-0-3

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the codex/upgrade-typesc... branch remains at 77%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.
File main ac9e1bc codex/upgrade-typesc... e45a8bb +/-
src/lib/messagi.../persistence.ts 95% 92% -3%
src/lib/credentials/store.ts 61% 59% -2%
src/lib/state/config-io.ts 95% 93% -2%
src/lib/agent/onboard.ts 71% 70% -1%
src/lib/agent/base-image.ts 82% 84% +2%
src/lib/inference/config.ts 93% 98% +5%
src/lib/agent/t...ersion-drift.ts 88% 96% +8%
src/lib/agent/b...availability.ts 63% 74% +11%
src/lib/onboard/config-sync.ts 31% 46% +15%
src/lib/sandbox...rsion-scheme.ts 73% 100% +27%

Updated July 09, 2026 21:39 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

E2E Advisor Recommendation

Required E2E: None
Optional E2E: openclaw-plugin-runtime-exdev-e2e

Dispatch hint: openclaw-plugin-runtime-exdev-e2e

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

  • None. No required live E2E: production runtime/user-flow code, installer/onboarding state machines, sandbox lifecycle, credentials, security boundaries, network policy, inference routing, and deployment logic are not changed. The deterministic risk plan lists no required jobs; the adjacent custom-plugin fixture lane is useful but not merge-blocking.

Optional E2E

  • openclaw-plugin-runtime-exdev-e2e (medium): Directly exercises the changed weather custom-plugin fixture by building and running it through the OpenClaw custom-plugin lifecycle and runtime-deps EXDEV regression path.

New E2E recommendations

  • None.

Dispatch hint

  • Workflow: .github/workflows/regression-e2e.yaml
  • jobs input: openclaw-plugin-runtime-exdev-e2e

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

E2E Target Recommendation

Required E2E targets: openclaw-plugin-runtime-exdev
Optional E2E targets: None

Dispatch required E2E targets:

  • gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=openclaw-plugin-runtime-exdev

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

  • openclaw-plugin-runtime-exdev: The weather plugin fixture manifest and lockfile changed. This fixture is consumed by the wired free-standing live E2E job that builds and validates the OpenClaw custom-plugin runtime lifecycle, including install, runtime inspection, tools catalog, tools.invoke, restart, recreation, and rebuild behavior.
    • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field jobs=openclaw-plugin-runtime-exdev

Optional E2E targets

  • None.

Relevant changed files

  • test/e2e/fixtures/plugins/weather/package-lock.json
  • test/e2e/fixtures/plugins/weather/package.json

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor (Nemotron Ultra) — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 1 test follow-up
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

  • PRA-T1 Add or justify test follow-up: Mocked behavioral coverage
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Mocked behavioral coverage — Add or confirm behavioral tests with mocked filesystem/network/process boundaries.. Changed code has I/O, state, credentials, provider, or config behavior that should be covered with behavioral mocks: nemoclaw/tsconfig.json. The TypeScript version upgrade is self-validating: tsc --noEmit and tsc build scripts in nemoclaw/package.json and root package.json, plus the weather fixture's build script, are the checked-in regression tests. If compilation fails, CI fails. The tool's 'mocks_recommended' verdict misapplied to nemoclaw/tsconfig.json (a static compiler config, not I/O-bound code). No new behavior, error paths, or mocked boundaries introduced.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@github-actions

github-actions Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 1 test follow-up

Action checklist

  • PRA-T1 Add or justify test follow-up: Mocked behavioral coverage
Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

  • PRA-T1 Mocked behavioral coverage — Add or confirm behavioral tests with mocked filesystem/network/process boundaries.. Changed code has I/O, state, credentials, provider, or config behavior that should be covered with behavioral mocks: nemoclaw/tsconfig.json. The risk plan lists no invariants or required jobs. Existing checked-in tests cover the changed fixture lockfile/review contract, TypeScript compiler API usage, source-loader behavior, and pre-push typecheck hook contracts; no concrete regression-test gap was identified for this metadata-focused change.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

@cv
cv merged commit 0b4d9a9 into main Jul 9, 2026
51 checks passed
@cv
cv deleted the codex/upgrade-typescript-6-0-3 branch July 9, 2026 21:39
Hadar301 pushed a commit to Hadar301/NemoClaw-OpenShift that referenced this pull request Jul 12, 2026
<!-- markdownlint-disable MD041 -->
## Summary
Aligns every direct TypeScript compiler dependency on 6.0.3, the newest
stable release that retains the compiler APIs used by NemoClaw's
repository checks and test loaders. This removes the split between
TypeScript 5.9 and 6.0 without introducing a second compatibility
package.

## Changes

- Pin the root, plugin, and weather E2E fixture TypeScript dependencies
and lockfiles to exact version 6.0.3.
- Add the plugin's explicit Node type set required by TypeScript 6
defaults.
- Revalidate the weather fixture dependency audit and update its
checked-in lockfile digest.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [x] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates
<!-- Check exactly one tests line and one docs line. Check other lines
when applicable. Add every requested justification or approval
reference. -->
- [ ] Tests added or updated for changed behavior
- [x] Existing tests cover changed behavior — justification:
compiler-API loading, source transpilation, plugin compilation, and the
fixture lock-review contract already have dedicated coverage; the
focused four-file integration run passed 130 tests.
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: this is an internal
development-tooling alignment with no CLI or runtime behavior change;
the required fixture dependency-review date and digest were refreshed,
and `npm run docs` completed with 0 errors and 2 warnings.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: reran `npm audit
--package-lock-only --ignore-scripts --json`; the reviewed
release-pinned fixture graph remains at 9 known vulnerabilities (3
moderate, 6 high), the advisory set is unchanged, and the lock-digest
enforcement test passed.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Verification
<!-- Check each applicable item only when supported by the requested
evidence. Run targeted tests once per relevant change set and rerun
after later edits or hook autofixes that can affect the tested behavior.
Do not rerun hook-covered checks. -->
- [x] PR description includes the DCO sign-off declaration and every
commit appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run check:diff` passed when hooks were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: `npx
vitest run --project integration test/inference-options-docs.test.ts
test/nemoclaw-start.test.ts test/source-require-loader.test.ts
test/e2e-fixture-dependency-review.test.ts` — 130 passed.
- [x] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result: `npm test` recorded 15,568
passes and its sole inherited-SSH assertion passed on an
environment-clean rerun; the `npm run check` structural/plugin gates
passed and the SSH-clean CLI coverage retry passed 13,742 tests with the
coverage ratchet satisfied.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
<!-- DCO sign-off is required in this PR description, and every commit
must appear as Verified in GitHub. Run: git config user.name && git
config user.email -->
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Chores**
* Updated TypeScript to version 6.0.3 across the project and related
test fixtures.
* Added Node.js type definitions to the TypeScript configuration for
more accurate type checking.

* **Documentation**
* Refreshed the security review record with the latest review date and
audit results.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
@wscurran wscurran added the chore Build, CI, dependency, or tooling maintenance label Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

chore Build, CI, dependency, or tooling maintenance

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants