chore: unify TypeScript on 6.0.3 across all five packages

[serendipty01]

Context & Requests for Reviewers

Closes #908.

Sets all five package.json files to typescript@^6.0.3 and regenerates the root, client, and server lockfiles (db/migrator already resolved 6.0.3, so their lockfiles are untouched).

Three things the issue did not anticipate, all of which reviewers should look at:

1. typescript-eslint had to be upgraded (^8.57.2 → ^8.64.0, server + client). The issue claimed typescript-eslint does not block this, citing its peer range >=4.8.4 <6.1.0. That is the range of the latest release; the version actually locked here was 8.57.2, whose peer is >=4.8.4 <6.0.0 — TS 6.0.3 falls outside it. npm install does not fail on this, it installs anyway and marks the peer invalid, so it would have shipped quietly. 8.64.0 still supports our eslint 9.

2. client/tsconfig.json: moduleResolution: "node" → "bundler". Required — the old value is the 2015-era CommonJS algorithm, incoherent when paired with "module": "esnext", and TS 6 hard-errors on the combination.

3. downlevelIteration removed from client/tsconfig.json. Deprecated in TS 6 (TS5101) and a no-op here anyway, since the client targets ESNext. Removing it is preferable to silencing with ignoreDeprecations.

Two latent bugs TS 6 flushed out

Both are pre-existing on main and fixed here:

• client/src/utils/collections.ts — Array.isArray() is typed arg is any[], which cannot narrow a readonly T[] out of a union (readonly arrays aren't assignable to any[]). It leaked into the else branch and widened arrayFromArrayOrSingleItem's return type. Replaced with a readonly-aware type guard.
• server/services/networkingService/index.ts — signWith is typed (data: ArrayBuffer) but was being handed a Uint8Array from TextEncoder.encode(). This was always a type lie that happened to work, because a Uint8Array is a valid BufferSource at runtime. TS 6 made Uint8Array generic over its backing buffer, which exposes it. Now passes a real ArrayBuffer.

One scoped lint disable

ItemInvestigation.tsx:407 keeps its cast with an added @typescript-eslint/no-unnecessary-type-assertion disable. This is a rule false positive: getFieldValueForRole is generic, and the rule compares against the post-inference contextual parameter type — but removing the cast changes which generic instantiation is inferred, and tsc then fails. eslint --fix stripped this cast (and its existing disable comment) and broke the build; tsc is the source of truth here. Five other assertions in this diff were genuinely redundant and were removed.

Known cosmetic wart

tsconfck (pulled in by vite-tsconfig-paths) peers typescript: ^5.0.0, so it reports as an invalid peer under TS 6. That peer is declared optional, so npm ci does not fail on it, and no published version admits TS 6 yet. Noting it so it isn't mistaken for a real break.

Tests

All CI jobs run locally and green:

Check	Result
npm run prettier (check_formatting)	pass
docker compose run --rm codegen-check	pass
backend npm run lint / npm run build	pass / pass
client npm run lint / npm run build	pass / pass
docker compose run --rm test	103 suites, 861 passed, 8 skipped, 0 failed
client unit tests	178 passed, 2 skipped

All four packages (client, server, db, migrator) type-check clean under 6.0.3.

(Optional) Rollout Plan

None — build-time only, no runtime or behaviour change.

Checklist

Only check items that apply to this PR; leave the rest unchecked.

• If you changed anything user-facing (i.e. user interface or APIs):
  Did you update the CHANGELOG.md and related docs?

• If you changed server/models/**/{ContentTypeModel,ActionModel,RuleModel,PolicyModel}.ts:
  Did you update the corresponding history tables and their triggers?

• If you changed db/src/scripts/** and used CREATE TABLE, ADD COLUMN, or ALTER COLUMN:
  Are as many columns marked NOT NULL as possible? If some columns can sometimes be null depending on other columns, are there CHECK constraints capturing those relationships, and are these also reflected using unions in the associated Kysely types?

• If you added a new signal in server/services/signalsService/signals/**:
  Did you classify every error case as a permanent error (SignalPermanentError, no retry) or a normal error (retryable)? Any case where the signal can't determine a score should be a SignalPermanentError.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 168ad9da-883a-479e-8dbb-9b0c770bf6b9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This pull request standardizes the repository’s tooling on TypeScript ^6.0.3 across the root, client, and server packages (with db/migrator already on 6.0.3), and applies a small set of TS6-driven configuration and type-correctness fixes to keep builds/lints/tests green.

Changes:

• Bump TypeScript to ^6.0.3 (root/client/server) and update client/server @typescript-eslint/* tooling to versions compatible with TS 6.
• Update TS configs to satisfy TS 6 constraints (server/tsconfig.json explicit types, client/tsconfig.json moduleResolution changes and removal of deprecated option).
• Fix TS 6-exposed type issues in a few code paths (HTTP signing buffer typing, readonly-array narrowing helper, and removal of now-redundant assertions/casts).

Reviewed changes

Copilot reviewed 12 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
package.json	Bumps root TypeScript devDependency to ^6.0.3.
package-lock.json	Regenerates root lockfile with TypeScript 6.0.3 resolved.
server/package.json	Bumps server TypeScript to ^6.0.3 and updates typescript-eslint tooling.
server/package-lock.json	Regenerates server lockfile for TS 6 + updated eslint tooling.
server/tsconfig.json	Explicitly declares types needed under TS 6 + NodeNext behavior changes.
server/services/networkingService/index.ts	Ensures signed request bodies are provided as a real ArrayBuffer (not a view) for TS 6-correct typing.
client/package.json	Bumps client TypeScript to ^6.0.3 and updates typescript-eslint tooling.
client/package-lock.json	Regenerates client lockfile for TS 6 + updated eslint tooling.
client/tsconfig.json	Switches to moduleResolution: "bundler" and removes deprecated/no-op downlevelIteration.
client/src/utils/collections.ts	Introduces a readonly-aware array type guard to preserve correct narrowing under TS 6.
client/src/webpages/dashboard/rules/rule_form/RuleFormReducers.test.ts	Removes now-unnecessary type import/casts after TS 6 tightening.
client/src/webpages/dashboard/rules/rule_form/RuleForm.tsx	Drops an unnecessary configuredParameters cast that TS 6 can validate directly.
client/src/webpages/dashboard/item_types/ItemTypePreview.tsx	Removes a now-unnecessary cast for the THREAD case when passing roles.
client/src/webpages/dashboard/mrt/manual_review_job/v2/ncmec/NCMECReviewUser.tsx	Removes an unnecessary type assertion on a default blur level value.
client/src/webpages/dashboard/investigation/ItemInvestigation.tsx	Documents/retains a TS6-required cast and adds a scoped eslint disable to prevent autofix breakage.

Files not reviewed (2)

• client/package-lock.json: Generated file
• server/package-lock.json: Generated file