[raymondfeng]

Upgrades the monorepo to TypeScript 7, using the side-by-side install recommended for TypeScript 7:

"@typescript/native": "npm:typescript@~7.0.2",
"typescript": "npm:@typescript/typescript6@~6.0.2"

Stacked PR. Per review, this PR was split. It builds on #11811 (typescript-eslint v8) and #11810 (mock-oauth2-provider CodeQL fix), whose commits appear here until they merge. The .yo-rc.json bug is fixed separately in #11812. Merge order: #11810 → #11811 → this PR. Only the last three commits belong to this PR.

TypeScript 7 no longer ships the JS compiler API: its exports["."] resolves to lib/version.cjs. So anything that introspects the compiler (@typescript-eslint, editor language services, tsserver) needs the API that @typescript/typescript6 still provides. The two packages declare different bin names (tsc vs tsc6), so they don't collide.

packages/build/package.json is the source of truth. bin/sync-dev-deps propagates the spec to every workspace package, and bin/update-template-deps carries it into the lb4 scaffolding templates.

A cold build of the monorepo drops from ~10.7s to ~2.1s.

Commits

1. feat(build)!: the toolchain, tsconfig.common.json, and the README. This is the only commit with BREAKING CHANGE:, so lerna's conventional-commit bump makes a major release of @loopback/build only.
   • @typescript/native is a hard dependency of @loopback/build, and lb-tsc always compiles with TypeScript 7. It prefers the project's own @typescript/native over the one @loopback/build depends on. The fallback to typescript/lib/tsc was unreachable and has been removed.
   • bin/sync-dev-deps.js had been broken since the Lerna → npm workspaces migration (d5c4994 removed loadLernaRepo). It's repaired using the @npmcli/map-workspaces pattern already used by update-template-deps.js.
2. feat(cli): generated projects target TypeScript 7 and drop moduleResolution: node. The template's mocha moves to ^12; update-template-deps syncs it with the monorepo, which already uses mocha 12.
3. fix:: the source changes TypeScript 6/7 requires, and the typescript alias in every package.

TypeScript 6/7 changes that required source updates

• moduleResolution: node (node10) was removed. tsconfig.common.json now sets "moduleResolution": "bundler" explicitly, which is the TypeScript 6 default. With module: commonjs it resolves exports maps using the require and types conditions. Because the resolver honors exports, @loopback/graphql no longer imports Middleware from a deep type-graphql path (that path isn't exported) and declares the type itself.
• @types/* packages are no longer auto-included. This accounted for 5630 of the 5668 initial errors (describe, process, NodeJS all unresolved). tsconfig.common.json now lists types: ["node", "mocha"].
• Reading a parent class field through super is an error (TS2855). cron declares fireOnTick as a field but installs it on the prototype, so @loopback/cron now calls it through BaseCronJob.prototype.
• Declaration emit no longer adds /// <reference path> for ambient files. TypeScript 5.2 emitted one into testlab/dist/expect.d.ts, which is how consumers resolved the global Internal type. Without it, expect silently becomes any in every consuming package, and api-extractor fails with Unable to follow symbol for "Internal". So should-as-function.d.ts moves to src/should-as-function.ts and exports its types as a module.
• Non-portable inferred types (TS2883). GRAPHQL_CONTEXT_RESOLVER gets an explicit type. Otherwise declaration emit has to name ContextFunction by its path inside @apollo/server.

With TypeScript 6 type information, typescript-eslint reports more findings:

• Async Express handlers in @loopback/rest and the rpc-server example now pass rejections to next.
• transactions.suite.ts awaits disconnect().
• ?? replaces || on objects and arrays. || is kept wherever the operand may be '' (see feat(eslint-config)!: upgrade typescript-eslint to v8 #11811 for the ignorePrimitives rationale).

Defects found along the way

• belongs-to-repository-factory.unit.ts never assigned companyRepo. Its stub helper assigned customerRepo twice, clobbering the previous beforeEach.
• The todo-list repository integration tests used repositories they never created.

Verification

Check	Result
Cold build (TS 7.0.2)	clean
npm run lint (eslint + prettier)	clean
@loopback/build tests	21 passing
npm run mocha	4492 passing; the 220 failures are identical to #11811 (TypeScript 5.2)

The 220 failures don't come from this change:

• Most are packages/cli generator tests. They refuse to prompt when stdin isn't a TTY, so they fail in a non-interactive shell.
• Two are the todo geocoder tests, whose fixtures don't match the live geocoder's current coordinates.

Checklist

• DCO (Developer Certificate of Origin) signed in all commits
• npm test passes on your machine: see Verification
• New tests added or existing tests modified to cover all changes
• Code conforms with the style guide
• API Documentation in code was updated
• Documentation in /docs/site was updated
• Affected artifact templates in packages/cli were updated
• Affected example projects in examples/* were updated

🤖 Generated with Claude Code

[samarpanB]

Thanks for this, the TS 6/7 investigation and the write-up are really thorough, and the build speedup is great.

My main concern is scope and semver. The PR bundles four independent changes: the TS 7 toolchain, typescript-eslint v8, ~60 ||→?? / ??= rewrites in framework code, and an unrelated CodeQL fix in the mock OAuth2 fixture. Two of them are breaking for downstream users but land under a non-breaking feat(build).

Blocking

1. @typescript/native is a hard dependency of @loopback/build, so the "fall back to typescript when TS 7 isn't installed" path is never reached for consumers. Any app pinned to TS 5.x gets compiled by TS 7 on a minor bump (see inline). This needs feat(build)! + BREAKING CHANGE:, or the native compiler should be opt-in.
2. @loopback/eslint-config → typescript-eslint v8 is also breaking for consumers (different peer ranges, new/renamed rules). It needs a major bump too.
3. packages/cli/.yo-rc.json is regenerated with every generator's arguments emptied (see inline).

Suggest splitting out

• The ||→?? conversions. Most are equivalent, but several change behavior when a value is '' in core packages (inline examples in context, core, boot; also extension-point.ts, inject-config.ts, controller-route.ts, build-schema.ts, repository.mixin.ts, lb3app.booter.ts restApiRoot). They may all be improvements, but they deserve their own refactor/fix PR. Here, the prefer-nullish-coalescing options (ignorePrimitives, ignoreTernaryTests, ignoreIfStatements) could keep this PR behavior-neutral.
• The fix(mock-oauth2-provider) commit. The fix looks right, but it's unrelated to the TS upgrade.

Minor

• try-catch-finally.unit.ts: three eslint-disable-next-line comments were replaced by blank lines. The lines can just be removed.
• graphql/keys.ts: a short comment on why the explicit BindingKey<...> annotation on GRAPHQL_CONTEXT_RESOLVER is needed would help.
• lb-ttsc / --use-ttypescript is now effectively TS 6-only. Worth a README note or a deprecation.
• The PR currently has merge conflicts with master.

Looks good: the duplicate route() overload removal, the should-as-function move (nice catch on expect silently becoming any), the cron fireOnTick fix, the sync-dev-deps.js repair, and the test fixes in belongs-to / todo-list / transactions.suite.

[raymondfeng]

@samarpanB this PR is now split per your review:

PR	Scope	Release
#11810	fix(mock-oauth2-provider): CodeQL fixes, redirect_uri validated before a token is issued	patch
#11811	feat(eslint-config)!: typescript-eslint v8, plus the lint fixes in separate commits	major, eslint-config only
#11793	feat(build)!: TypeScript 7 (stacked on the two above)	major, build only
#11812	fix(cli): the if (!gen) metadata bug	patch

|| → ??: lint runs without strictNullChecks, so prefer-nullish-coalescing couldn't tell a string operand from a nullable one. On master it even flagged boolean || boolean in relation.helpers.ts. #11811 sets ignorePrimitives for strings, numbers and booleans, so only == null-style rewrites remain. Every rewrite where '' or 0 could change the result was reverted. That includes all the sites you listed, plus rpc-server (port: 0), http-caching-proxy (statusCode: 0), buffer.ts (encoding: '' would have thrown ERR_UNKNOWN_ENCODING), and the CLI app template's process.env.HOST, where an empty HOST would have bound to all interfaces.

Minor items:

• try-catch-finally.unit.ts: the blank lines are removed (feat(eslint-config)!: upgrade typescript-eslint to v8 #11811).
• graphql/keys.ts: commented. The annotation avoids TS2883, which I confirmed by building without it.
• lb-ttsc: the README notes that it compiles with the JS compiler from typescript, not TypeScript 7. The old sentence claiming it falls back to tsc when ttypescript is missing was wrong (it exits with an error) and is removed.
• Merge conflicts: resolved; everything is rebased on current master.