← All reportsPublic report

microsoft/typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

111k stars Go View on GitHubprofiled 11d ago
Try GitZoid
155PRs this week
35Contributors
421Deps scanned
1Issues found
01 · Repo overview

How typescript is put together

This is the native (Go) port of the TypeScript compiler ('tsgo'). The core compiler—scanner/parser, binder, checker, emitter—is written in Go under tsc/internal/*, exposed both as a CLI (tsc/cmd/tsc) and as an LSP-style language/API server communicating over pipes using a MsgPack-based protocol defined in tsc/internal/api/proto.go. A thin npm workspace package (packages/typescript) wraps platform-specific native binaries and exposes unstable JS APIs, and a VS Code extension (packages/vscode-typescript) launches and manages the language-server session. Go tooling under tools/ provides custom lint analyzers and code generators that emit TypeScript protocol/AST bindings from Go source.

Languages

GoTypeScriptJavaScript

Frameworks

vscode-languageclient (VS Code extension API)vscode-jsonrpcGo analysis framework (golang.org/x/tools/go/analysis)hereby (task runner)dprint (formatter)golangci-lint

Infrastructure

Azure Pipelines (tools/pipelines/*.yml)GitHub Actions CI (ci.yml badge)Devcontainer (.devcontainer/devcontainer.json)Volta-pinned Node 22.22.0 / npm 11.17.0

Major components

tsc/internal/compiler

File loading/parsing, module resolution, program construction, and JavaScript emission for the native compiler.

tsc/internal/checker

Type checking, inference, flow analysis, JSDoc/JSX support, and type-node printing for diagnostics and hovers.

tsc/internal/api

Implements the language-service server: sessions, request dispatch, callback filesystem, and the MsgPack wire protocol shared with JS clients.

tsc/cmd/tsc

CLI entrypoint wiring command-line compilation, the LSP server mode, and process-liveness/platform shims.

packages/typescript

npm distribution wrapper that resolves and spawns the platform-native tsgo binary and exposes unstable sync/async/AST JS APIs.

packages/vscode-typescript

VS Code extension managing language-server lifecycle, configuration middleware, status bar, project status, telemetry, and content-mapper contributions.

tools/customlint

Custom Go static-analysis passes (unexported API leakage, shadowing, parent-access bans, cleanup checks) run via golangci-lint.

tools/gen-proto

Generator that reflects over tsc/internal/api Go handlers to produce the TypeScript protocol type definitions.

The last few weeks show the TypeScript team steadily merging its experimental Go-based rewrite (TypeScript 7) into the main repository, bringing over dozens of bug fixes, editor improvements, and performance optimizations while also expanding the public API surface. Alongside that migration, the classic JavaScript codebase received targeted fixes and infrastructure work like faster CI and safer dependency updates. The overall arc is one of a large-scale platform transition paired with relentless polish on crashes, diagnostics, and tooling reliability.

Week by week

2026-08-24A quieter week focused on stability fixes, CI speedups, and build tooling cleanup.latest6 changes

Fix

Fixed binder race condition

Resolved a timing issue where parts of the compiler could read incomplete information during program analysis.

Refactor

Faster continuous integration

Split CI across more parallel jobs so test results come back sooner with less redundant work.

Refactor

Fewer memory allocations when checking project references

Reduced unnecessary memory use when the compiler verifies declaration directories in project references.

Fix

Fixed extension launching

Corrected a problem preventing the TypeScript extension from starting properly.

Chore

Pinned gzip for localization generation

Locked down the compression tool version used to generate translated files for reproducible builds.

Fix

Fixed crash on nil pointer during name checks

Prevented a panic in the Go-based compiler when checking certain names.

2026-08-17The big TypeScript 7 migration landed: the Go rewrite's repository layout was merged into the main repo alongside a wave of API additions and fixes.6 changes

Refactor

Applied the TypeScript 7 repository layout

Restructured the main repository to accommodate the Go-based next-generation compiler, including renaming the module and removing legacy submodules.

Feature

New API methods for type inspection

Added getReducedType(), TypeFormatFlags, StructuredType, and other tools so external programs can inspect types more richly.

Fix

Deduplicated repeated declarations on union/intersection properties

Cleaned up cases where the same property appeared multiple times when combining types.

Fix

Fixed crash in control-flow analysis for throwing for-in/for-of loops

The compiler no longer crashes when a loop's source expression can throw an error.

Feature

Content mappers round 2

Continued building infrastructure for mapping content between the old and new compiler implementations.

Chore

Improved CI infrastructure

Switched to a new GitHub runner pool, custom Go download URLs, and added a package feed check to catch release problems early.

2026-08-10A very busy week of porting features to the Go compiler: editor completions, transpilation APIs, many crash fixes, and new platform targets.6 changes

Feature

Completion snippets in the editor

Autocomplete suggestions can now offer fill-in templates, not just plain names.

Feature

Ported transpileModule and transpileDeclaration

Brought the ability to convert single files of TypeScript to JavaScript over to the new Go-based compiler.

Refactor

Balanced file assignment to checkers

Files are now distributed across parallel type-checkers more evenly using import relationships, speeding up large projects.

Fix

Many parser and diagnostic fixes

Corrected handling of exponentiation operators with 'as'/'satisfies', private names in type queries, regex Unicode sets, and several misleading or missing error messages.

Fix

LSP server reliability improvements

The language server now survives response serialization failures and handles malformed tsconfig files without crashing.

Feature

Android ARM64 release target

The native compiler can now be built and released for Android ARM64 devices.

2026-08-03A small week with four targeted fixes to the language server and type system internals.4 changes

Feature

Configurable workspace symbol search scope

Editors can now control whether workspace-wide symbol searches include JavaScript files and pass extra parameters.

Fix

Fixed LSP watcher panic

Prevented a crash when closing the file watcher at the same moment it was asked to watch new files.

Fix

Ordered variance computation by associated type symbol

Made type-compatibility calculations deterministic by processing related types in a consistent order.

Fix

Avoided false symlink mappings

Stopped the compiler from incorrectly treating physical dependencies as symlink duplicates.

2026-07-27A heavy performance-and-stability week: numerous stack-overflow and out-of-memory crashes fixed, plus broad watcher and parsing speedups.6 changes

Refactor

Optimized type narrowing operations

Speeded up the logic that figures out what a variable must be after equality checks and switch statements.

Fix

Fixed O(K^2) memory blowup in go-to-implementation

The editor feature that jumps to implementations no longer consumes runaway memory on large codebases.

Fix

Multiple stack-overflow crash fixes

Self-referential for-of loops and inherited JSDoc comments no longer cause the compiler to recurse until it crashes.

Refactor

Watcher performance improvements

File-watching got faster and now avoids pointless diagnostic refreshes triggered by irrelevant file events.

Fix

Fixed build mode stall on large solutions

Projects configured in build mode no longer hang when working with very large solutions.

Fix

Restored tsconfig diagnostics and suggestions

Misspelled tsconfig options get spelling suggestions again, misplaced options are reported, and missing TS5092/TS7059 errors were restored.

03 · Security check

Dependencies and code review

421 dependencies scanned

Dependency advisories

Security Watch

1 vulnerable package (1 advisories) across 421 scanned dependencies.

warninghigh · npmfixed in 0.6.0

adm-zip 0.5.18

1 advisory. Fixed in 0.6.0.

How it can be abusedAn attacker could send a specially crafted ZIP file that tricks adm-zip into reserving 4 gigabytes of memory, crashing or freezing whatever process reads it. In this repo that would matter mainly if build or packaging scripts ever unzip files from outside sources; the shipped compiler and language server are Go programs that never use this package.

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required