refactor: Upgrade to TypeScript 6.0.2

[ivov]

Summary

What changed in TS 6	Changes made to adapt
types defaults to [] instead of auto-including all @types/*	Added types: ["node", "jest"] to codemirror-lang and stylelint-config packages (longer term, these FE packages should stop using Jest!). Switched @n8n/json-schema-to-zod to extend tsconfig.backend.json which already carries them. Excluded test helper dirs from nodes-base's build tsconfig. Added tsconfig.scripts.json to @n8n/extension-sdk to cover the orphaned scripts/ directory that uses Node built-ins.
rootDir defaults to the tsconfig dir instead of being inferred from sources	Added explicit rootDir: "src" to the three standalone @n8n/json-schema-to-zod build configs. Added rootDir: "." to ts-jest's inline tsconfig in the root jest.config.js to fix TS5011 when ts-jest compiles a single file (e.g. globalSetup.ts) in isolation.
Cross-package path aliases fail when outDir is set without rootDir	Replaced outDir: "dist" with noEmit: true in design-system, rest-api-client, editor-ui, and storybook tsconfigs (all use Vite/tsdown for building, never tsc)
noUncheckedSideEffectImports enabled by default under strict	Set to false in both base tsconfig.common.json and modern/tsconfig.json (will need to be a separate dedicated effort)
moduleResolution: node and module: umd are deprecated	Added ignoreDeprecations: "6.0" to the two shared base configs and two standalone configs that use these settings (will need to be a separate dedicated effort)
DOM lib updated with new interface members	Edited a polyfill in editor-ui/__tests__/setup.ts
Uint8Array is now Uint8Array<ArrayBufferLike>; WebSocket.send() requires Uint8Array<ArrayBuffer>	Type cast at the call site in @n8n/crdt (will need to be a separate dedicated to propagate through Y.js call sites, best done by folks who know this package)
Property access on never is now a type error	Cast body in the default branch of an exhaustive switch in log-streaming.controller.ts

Related Linear tickets, Github issues, and Community forum posts

Separate dedicated efforts are tracked here:

• https://linear.app/n8n/issue/CAT-2713
• https://linear.app/n8n/issue/CAT-2714
• https://linear.app/n8n/issue/CAT-2715

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

[codecov]

Bundle Report

Changes will increase total bundle size by 26.75kB (0.06%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
editor-ui-esm	43.04MB	26.75kB (0.06%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: editor-ui-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
assets/typescript.worker-*.js	26.75kB	10.7MB	0.25%
assets/worker-*.js	2.93MB	2.95MB	21929.4% ⚠️
assets/worker-*.js	-2.93MB	13.37kB	-99.55%
assets/expression-*.js	11 bytes	220 bytes	5.26% ⚠️
assets/expression-*.js	-11 bytes	209 bytes	-5.0%

[cubic-dev-ai]

No issues found across 19 files

Architecture diagram

sequenceDiagram
    participant CI as CI / Developer
    participant TSC as TypeScript Compiler (v6.0.2)
    participant Bundler as Bundler (Vite / tsdown)
    participant BE as Node.js Backend
    participant FE as Browser / Editor UI
    participant WS as WebSocket API

    Note over CI,TSC: Build Time: Configuration Phase
    CI->>TSC: Run type checking (tsc)
    TSC->>TSC: Resolve tsconfig.common.json
    Note right of TSC: CHANGED: Set ignoreDeprecations "6.0"<br/>CHANGED: Disable noUncheckedSideEffectImports

    alt Frontend Packages (@n8n/design-system, editor-ui)
        TSC->>TSC: Perform type validation
        Note right of TSC: CHANGED: noEmit: true (TSC no longer writes files)
        CI->>Bundler: Generate runtime assets
        Bundler-->>FE: Load bundled assets
    else Backend/Shared Packages (@n8n/json-schema-to-zod, nodes-base)
        TSC->>TSC: CHANGED: Resolve types from "node", "jest"
        TSC->>BE: CHANGED: Emit JS to /dist (Explicit rootDir: "src")
    end

    Note over FE,WS: Runtime: Frontend & Communication
    FE->>FE: NEW: Polyfill IntersectionObserver.scrollMargin
    FE->>FE: NEW: Polyfill PointerEvent.persistentDeviceId
    
    Note over FE,WS: @n8n/crdt Transport
    FE->>WS: CHANGED: send(data as Uint8Array<ArrayBuffer>)
    Note right of FE: TS 6.0 compatibility: explicit narrowing<br/>to ArrayBuffer variant of Uint8Array

    Note over BE: Runtime: Backend Logic
    BE->>BE: Execute transpiled code

Loading

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...dules/log-streaming.ee/log-streaming.controller.ts	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[ivov]

Chromatic is unrelated and advisory so disregarding

[Matsuuu]

🚀 📦

[ivov]

One more please, the e2e issue was legit

[ivov]

Unit test issue is unrelated, fixing at #27738

[aikido-pr-checks]

CVE-2026-33532 in yaml - medium severity
yaml is a YAML parser and serialiser for JavaScript. Parsing a YAML document with a version of yaml on the 1.x branch prior to 1.10.3 or on the 2.x branch prior to 2.8.3 may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a RangeError: Maximum call stack size exceeded with a small payload (~2–10 KB). The RangeError is not a YAMLParseError, so applications that only catch YAML-specific errors will encounter an unexpected exception type. Depending on the host application's exception handling, this can fail requests or terminate the Node.js process. Flow sequences allow deep nesting with minimal bytes (2 bytes per level: one [ and one ]). On the default Node.js stack, approximately 1,000–5,000 levels of nesting (2–10 KB input) exhaust the call stack. The exact threshold is environment-dependent (Node.js version, stack size, call stack depth at invocation). Note: the library's Parser (CST phase) uses a stack-based iterative approach and is not affected. Only the compose/resolve phase uses actual call-stack recursion. All three public parsing APIs are affected: YAML.parse(), YAML.parseDocument(), and YAML.parseAllDocuments(). Versions 1.10.3 and 2.8.3 contain a patch.

Details

Remediation Aikido suggests bumping this package to version 2.8.3 to resolve this issue

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
More info

[ivov]

Once more please, bounced back from the queue due to a flaky test and accumulated conflicts with master

[n8n-assistant]

Got released with n8n@2.16.0