Skip to content

Add submission package for microsoft/TypeScript #55091 - #36

Draft
vaibhav4046 wants to merge 2 commits into
mainfrom
claude/merged-pr-major-tech-lc7s9k
Draft

Add submission package for microsoft/TypeScript #55091#36
vaibhav4046 wants to merge 2 commits into
mainfrom
claude/merged-pr-major-tech-lc7s9k

Conversation

@vaibhav4046

@vaibhav4046 vaibhav4046 commented Aug 28, 2026

Copy link
Copy Markdown
Owner

Stores the prepared upstream contribution for microsoft/TypeScript#55091 so it survives this session's container.

What's here

contrib/typescript-55091/ contains:

  • fix.patch - the change against microsoft/TypeScript main (the Go compiler)
  • PR_BODY.md - the upstream PR description, including the AI-assistance disclosure that repo's CONTRIBUTING.md requires
  • README.md - reproduction, root cause, verification performed, submission steps, and an honest merge-probability assessment

The bug

constantExpression() in tsc/internal/transformers/tstransforms/utilities.go emitted bare Infinity / -Infinity / NaN identifiers for enum members whose initializers fold to those values. Identifiers resolve in the emitted code's scope, so a local binding that shadows them silently changes the value. Reproduced on published TypeScript 7.0.2:

{
  let Infinity = 3;
  enum A { X = 1 / 0 }
  console.log(A.X);   // prints 3, expected Infinity
}

No diagnostic is issued. const enum is guarded by TS2477/TS2478; plain enum is not. The fix emits 1 / 0, -1 / 0, and 0 / 0, which cannot be shadowed.

Verification

go build ./... clean; go test ./internal/testrunner/ -run TestLocal passes with updated baselines; go test ./... 62 packages pass, with internal/astnav failing on a missing node_modules/typescript — confirmed identical with the fix stashed. gofmt -l and go vet clean. Patched compiler built and diffed before/after on the real repro.

Not run: the npx hereby wrappers, as npm dependencies were not installed here.

Not submitted upstream

microsoft/TypeScript's CONTRIBUTING.md accepts a PR only where "a specific human operator has chosen this specific issue, intends to shepherd the change through review themselves, and will be the one responding to feedback in their own personal workflow," and requires disclosed AI assistance. Submission is therefore a manual step — steps are in contrib/typescript-55091/README.md.

Generated by Claude Code

Vaibhav Lalwani
Add submission package for microsoft/TypeScript issue 55091
bdc0b25 
Prepared fix, regression test, PR body and verification record for the
enum non-finite constant emit bug. Not yet submitted upstream.
@vercel

vercel Bot commented Aug 28, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
queueproof Ready Ready Preview Aug 28, 2026 11:01am

Vaibhav Lalwani
Pin nanoid to the 3.3.18 patched release
a3b7598 
GHSA-2v37-7h3g-55p8 raised the patched floor for nanoid to >=3.3.18, so the
3.3.17 override pinned in #35 now fails the production dependency audit. The
advisory reaches the graph transitively through next > postcss > nanoid.

Bump the existing override in pnpm-workspace.yaml, keep package.json in sync,
and regenerate the lockfile.
@vaibhav4046 Claude

vaibhav4046 commented Aug 28, 2026

Copy link
Copy Markdown
Owner Author

The Type, lint, test, benchmark, build check failed at the Reject production dependency advisories step, on a high advisory for nanoid reached transitively via next > postcss > nanoid (GHSA-2v37-7h3g-55p8).

This was not caused by this PR: the commit under test added three files under contrib/typescript-55091/ and touched no manifest or lockfile. main carries the same nanoid: 3.3.17 override, so it fails identically today. The last green run on main (#194, a759bf9) predates the advisory, which is why it passed then — pnpm audit resolves against a live feed, so the same tree changes verdict over time.

#35 pinned nanoid: 3.3.17 when that was the patched release; the advisory has since raised the floor to >=3.3.18. I applied the same fix at the new version: bumped the override in pnpm-workspace.yaml (the one pnpm 10 actually reads), kept the package.json block in sync as #35 did, and regenerated the lockfile. Diff is 3 files, version bump only.

Verified locally, reproducing the failure first and then the fix:

  • pnpm audit:dependencies — was exit 1 with the high advisory, now No known vulnerabilities found, exit 0
  • pnpm typecheck and pnpm lint — clean
  • pnpm test — 74 files, 654 tests passed
  • pnpm benchmark:router — PASS, 353 fixture assertions
  • pnpm build — clean
  • node scripts/test-secret-scan.mjs — exit 0

One step I could not run here: pnpm scan:secrets requires a full-history checkout and my clone is shallow. CI checks out with fetch-depth: 0, so it should run normally there; flagging it rather than claiming a pass I did not observe.

Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vaibhav4046