Upgrade to TypeScript 7 once typescript-eslint supports it

Start by checking whether a typescript-eslint release supports TypeScript 7, the stated blocker. Then update TaskFlow.Web/package.json and its lockfile, remove the TypeScript ignore entry and comment in .github/dependabot.yml, and run the listed install, lint, type-check, test, build, and security-scan checks. Done when all acceptance criteria pass and Dependabot can open TypeScript major PRs again.

Groomed 2026-10-30 — ready for implementation.

Original Description

Split from #277. Dependabot major PRs for typescript are ignored in .github/dependabot.yml (#282) until this is done.

Background

TypeScript 7 (7.0.2 is latest on npm) cannot be installed in TaskFlow.Web. Every @typescript-eslint/* package, including typescript-eslint 8.72.1 and its canary builds, declares the peer range typescript >=4.8.4 <6.1.0. npm ci fails with ERESOLVE (seen in the closed Dependabot PR for typescript 7.0.2). @hey-api/openapi-ts ^0.99.0 already accepts TypeScript 7, so it is not a blocker.

Last checked 2026-10-30 (npm view): typescript-eslint latest is 8.72.1 with peer typescript >=4.8.4 <6.1.0, and typescript latest is 7.0.2. No typescript-eslint release supports TypeScript 7. The issue carries the blocked label until one does.

Blocker

A typescript-eslint release whose typescript peer range includes 7.x.

Work

• Bump typescript and typescript-eslint together in TaskFlow.Web/package.json and refresh the lockfile
• Fix any new type-check or lint errors
• Remove the typescript ignore entry (and its comment line) from the npm block in .github/dependabot.yml

Acceptance criteria

• npm ci, npm run lint, npm run type-check, npm run test -- --run --coverage and npm run build pass in TaskFlow.Web (coverage stays at or above the 80% line threshold)
• The security-scan.yml web image build passes
• Dependabot can open typescript major PRs again

Related: #277

User Story

As a maintainer of TaskFlow, I want the web project to build, lint and test on TypeScript 7 with a matching typescript-eslint, so that the project stays on a supported compiler, and Dependabot can again propose major typescript updates without producing PRs that fail to install.

Gated on an external release. Implementation cannot start until a typescript-eslint release lists 7.x in its typescript peer range. The TypeScript 7 / typescript-eslint status comes from the issue text (last checked 2026-10-20) and has not been re-verified.

Acceptance Criteria

Precondition and gating:

• Given no typescript-eslint release declares a typescript peer range that includes 7.x, when someone picks up this story, then no work starts, and the typescript ignore entry in .github/dependabot.yml stays in place.
• Given a typescript-eslint release whose peer range includes 7.x exists, when typescript and typescript-eslint are bumped together in TaskFlow.Web/package.json and the lockfile is refreshed, then npm ci completes with no ERESOLVE error.

Build and quality checks, run in TaskFlow.Web:

• Given the upgraded dependencies, when npm run lint runs, then it exits with no errors.
• Given the upgraded dependencies, when npm run type-check runs, then it exits with no errors, including the generated src/api/client code, which is type-checked but not linted.
• Given the upgraded dependencies, when npm run test -- --run --coverage runs, then all tests pass and line coverage is at or above 80%.
• Given the upgraded dependencies, when npm run build runs, then it exits successfully.

CI and Dependabot:

• Given the upgrade is on a branch, when the taskflow-web job in ci.yml runs, then it passes.
• Given the upgrade is on a branch, when the web image build in security-scan.yml runs, then it passes.
• Given the typescript ignore entry and its comment lines are removed from the npm block in .github/dependabot.yml, when the file is reviewed, then the vite and vitest ignore entries and their comments are unchanged.
• Given the ignore entry is removed, when Dependabot next runs, then it can open a typescript major-version PR.

Edge Cases

• Build scripts. npm run build is tsc -b && vite build and type-check is tsc -b --noEmit. It is unverified whether TS 7 supports these invocations, the tsc bin and the tsbuildinfo paths in the same way.
• Strictness. tsconfig.app.json sets no explicit strict, so it relies on the compiler default. If TS 7 changes that default, checking could tighten or loosen without any config change.
• Test typings. src/test/jest-dom.d.ts declares a vitest module shim that depends on vitest 5 Matchers typings and could break under TS 7.
• Generated client. src/api/client is excluded from lint but is type-checked. TS 7 errors there cannot be fixed by hand edits; regenerate with @hey-api/openapi-ts (^0.99.0 already accepts TS 7).
• Docker. The Dockerfile runs npm ci and npm run build. ghcr-deploy.yml builds and pushes the web image on every main push, so a bad upgrade not caught earlier would surface at deploy time.
• Premature ignore removal. Removing the Dependabot ignore before typescript-eslint supports TS 7 makes Dependabot open PRs that fail with ERESOLVE. Remove it in the same PR as the upgrade.

Out of Scope

• Upgrading vite, vitest or @vitest/coverage-v8; their Dependabot ignores and comments stay.
• Switching ESLint to type-checked rule sets; the config stays on tseslint.configs.recommended.
• Changing tsconfig strictness or adding compiler options beyond what is needed to pass the checks.
• Bumping @hey-api/openapi-ts or restructuring the generated client, unless TS 7 errors force a regeneration.
• Backend (TaskFlow.Api) changes.
• Pre-release or canary typescript-eslint builds; the work waits for a release.