Conversation
openapi-typescript 7.13.0 peers on typescript ^5.x, so the grouped bump to typescript 7.0.2 fails npm ci with ERESOLVE in every TypeScript job and holds back the other dev updates in the group. fizzy-sdk and basecamp-sdk carry the same ignore for the same reason.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
Copilot review overview
🟢 Approved
The configuration is valid, narrowly scoped, and consistent with the documented peer dependency constraint.
Review effort: Balanced
Findings: None
What changed in this PR
Pins Dependabot’s TypeScript updates to major version 5 while openapi-typescript requires TypeScript ^5.x.
Changes:
- Ignores semver-major TypeScript updates.
- Preserves minor and patch updates within TypeScript 5.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
| File | Description |
|---|---|
.github/dependabot.yml |
Adds the scoped TypeScript major-version exclusion. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
#195 has been red since 2026-09-17 because it bumps
typescriptfrom 5.9.3 to 7.0.2, andopenapi-typescript@7.13.0(the latest release) declarespeerDependencies: { typescript: "^5.x" }.npm cistops with ERESOLVE before anything runs, so every TypeScript job, the conformance job andnpm auditfail (run). Upstream tracks TypeScript 7 support in openapi-ts/openapi-typescript#2841, still open.Because the group is all-or-nothing, the other three updates in it (
@types/node26.5.1,semver7.8.5,vitest5.0.0) are held back too. This adds a semver-major ignore fortypescriptto the npm entry, the same rule fizzy-sdk and basecamp-sdk already carry. Minor and patch TypeScript 5 updates still come through. Once this merges, dependabot rebuilds the group without the TypeScript major.Checked the rebuilt group locally on Node 24: with those three updates applied on top of main,
npm run typecheck,npm run build,npm run check:generatedandnpm run conformance(191 passed) all pass, andnpm testpasses apart from one test that calls/bin/true, which does not exist on macOS and does exist on the Linux runners.The
GitHub Actions auditcheck is red on main since 2026-09-20 for an unrelated reason (zizmor's ref-version-mismatch on thedtolnay/rust-toolchainpin intest.yml); #222 already fixes that, so this PR will show the same red until #222 lands.Summary by cubic
Stops the TypeScript major-version bump from breaking CI by holding Dependabot to TypeScript 5 until
openapi-typescriptadds TypeScript 7 support.The ignored update-types only cover semver-major versions for
typescript, so minor and patch TypeScript 5 updates still flow through. This unblocks the other dev dependencies (@types/node,semver,vitest) that dependabot's all-or-nothing grouping had been holding back.Written for commit 92712c7. Summary will update on new commits.