Simple utils ts migration

[Ryang-21]

Converts a single file in the util folder to check migration process

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​typescript-eslint/​parser@​6.21.0 ⏵ 8.54.0	+1		+1
	@​babel/​preset-typescript@​7.28.5
	typescript-eslint@​8.54.0
	@​babel/​register@​7.28.3 ⏵ 7.28.6				-1
	@​babel/​preset-env@​7.28.5 ⏵ 7.29.0				-1
	@​babel/​cli@​7.28.3 ⏵ 7.28.6
	@​babel/​eslint-parser@​7.28.5 ⏵ 7.28.6
	vitest@​4.0.18
	@​babel/​core@​7.28.5 ⏵ 7.29.0
	@​types/​node@​20.19.25 ⏵ 20.19.32	+1		+1	+1
	globals@​17.3.0
	webpack@​5.104.1 ⏵ 5.105.0			+1
	typescript@​5.6.3 ⏵ 5.9.3			+1
	prettier@​3.7.4 ⏵ 3.8.1			+1
	@​eslint/​compat@​2.0.2
	eslint@​9.39.2
	@​eslint/​js@​9.39.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: npm @esbuild/android-arm under BSD-3-Clause AND MIT Location: Package overview From: pnpm-lock.yaml → npm/@esbuild/android-arm@0.27.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@esbuild/android-arm@0.27.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @esbuild/android-x64 under BSD-3-Clause AND MIT Location: Package overview From: pnpm-lock.yaml → npm/@esbuild/android-x64@0.27.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@esbuild/android-x64@0.27.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm @esbuild/openharmony-arm64 under BSD-3-Clause AND MIT Location: Package overview From: pnpm-lock.yaml → npm/@esbuild/openharmony-arm64@0.27.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@esbuild/openharmony-arm64@0.27.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm caniuse-lite under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (npm metadata) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/LICENSE) License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/package.json) From: pnpm-lock.yaml → npm/@babel/preset-env@7.29.0 → npm/@babel/core@7.29.0 → npm/webpack@5.105.0 → npm/caniuse-lite@1.0.30001768 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/caniuse-lite@1.0.30001768. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm diff under BSD-3-Clause Location: Package overview From: pnpm-lock.yaml → npm/@definitelytyped/dtslint@0.0.182 → npm/diff@3.5.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/diff@3.5.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm diff under BSD-3-Clause Location: Package overview From: pnpm-lock.yaml → npm/ts-node@10.9.2 → npm/diff@4.0.4 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/diff@4.0.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm diff under BSD-3-Clause Location: Package overview From: pnpm-lock.yaml → npm/mocha@10.8.2 → npm/sinon@16.1.3 → npm/diff@5.2.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/diff@5.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm esquery under BSD-3-Clause Location: Package overview From: pnpm-lock.yaml → npm/eslint@9.39.2 → npm/@definitelytyped/dtslint@0.0.182 → npm/esquery@1.7.0 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esquery@1.7.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm qs under BSD-3-Clause Location: Package overview From: pnpm-lock.yaml → npm/karma@6.4.4 → npm/node-polyfill-webpack-plugin@3.0.0 → npm/qs@6.14.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/qs@6.14.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm source-map-js under BSD-3-Clause Location: Package overview From: pnpm-lock.yaml → npm/vitest@4.0.18 → npm/source-map-js@1.2.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/source-map-js@1.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm typescript under CC-BY-4.0 License: CC-BY-4.0 - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) License: LicenseRef-W3C-Community-Final-Specification-Agreement - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) License: MIT-Khronos-old - the applicable license policy does not allow this license (4) (package/ThirdPartyNoticeText.txt) From: package.json → npm/typescript@5.9.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typescript@5.9.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm vite Location: Package overview From: pnpm-lock.yaml → npm/vitest@4.0.18 → npm/vite@7.3.1 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@7.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm vite is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: pnpm-lock.yaml → npm/vitest@4.0.18 → npm/vite@7.3.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vite@7.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: npm vitest Location: Package overview From: package.json → npm/vitest@4.0.18 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/vitest@4.0.18. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

This PR attempts an initial TypeScript migration by converting a small util (checksum) to TS, but also expands into a broader tooling/build migration (pnpm, new tsconfigs, ESLint v9 flat config, workflow/script updates) and wide repo-wide formatting changes.

Changes:

• Add TS build/typecheck scaffolding (tsconfig*.json) and Vitest configuration + a new TS unit test for verifyChecksum.
• Migrate src/util/checksum from JS to TS with explicit parameter/return types.
• Switch tooling/CI/scripts toward pnpm + ESLint v9 flat config, and reformat many files to match updated Prettier settings (double quotes).

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
vitest.config.mts	Adds Vitest configuration for running new TS tests.
types/test.ts	Updates type expectations for newer Node Buffer generic typing.
types/.eslintrc.js	Formatting change (quote style).
type_validation/util/checksum.d.ts	Adds generated/declared TS typings for migrated checksum util.
tsconfig.json	Adds root TS config for IDE/typecheck (noEmit).
tsconfig.cjs.json	Adds TS config intended to compile CJS output.
tsconfig.base.json	Introduces shared strict TS compiler options baseline.
test/unit/util/continued_fraction_test.js	Formatting changes to align with updated Prettier settings.
test/unit/util/checksum.test.ts	Adds Vitest coverage for verifyChecksum behavior.
test/unit/util/bignumber_test.js	Formatting changes to align with updated Prettier settings.
test/unit/transaction_envelope_test.js	Formatting changes to align with updated Prettier settings.
test/unit/sorobandata_builder_test.js	Formatting changes to align with updated Prettier settings.
test/unit/soroban_test.js	Formatting changes to align with updated Prettier settings.
test/unit/signing_test.js	Formatting changes to align with updated Prettier settings.
test/unit/signerkey_test.js	Formatting changes to align with updated Prettier settings.
test/unit/scint_test.js	Formatting changes to align with updated Prettier settings.
test/unit/operations/invoke_host_function_test.js	Formatting changes to align with updated Prettier settings.
test/unit/operations/extend_restore_test.js	Formatting changes to align with updated Prettier settings.
test/unit/muxed_account_test.js	Formatting changes to align with updated Prettier settings.
test/unit/memo_test.js	Formatting changes to align with updated Prettier settings.
test/unit/liquidity_pool_id_test.js	Formatting changes to align with updated Prettier settings.
test/unit/keypair_test.js	Formatting changes to align with updated Prettier settings.
test/unit/invocation_test.js	Formatting changes to align with updated Prettier settings.
test/unit/i256_test.js	Formatting changes to align with updated Prettier settings.
test/unit/hashing_test.js	Formatting changes to align with updated Prettier settings.
test/unit/events_test.js	Formatting changes to align with updated Prettier settings.
test/unit/crypto_test.js	Formatting changes to align with updated Prettier settings.
test/unit/contract_test.js	Formatting changes to align with updated Prettier settings.
test/unit/claimant_test.js	Formatting changes to align with updated Prettier settings.
test/unit/auth_test.js	Formatting changes to align with updated Prettier settings.
test/unit/account_test.js	Formatting changes to align with updated Prettier settings.
test/test-helper.js	Switches Node test bootstrap from Babel register to ts-node register.
test/test-helper-browser.js	Extracts browser-only chai-as-promised setup for Karma runs.
test/.eslintrc.js	Formatting change (quote style).
src/xdr.js	Formatting change (quote style) for imports.
src/util/util.js	Formatting change (quote style).
src/util/decode_encode_muxed_account.js	Formatting change (quote style) + string literal normalization.
src/util/continued_fraction.js	Formatting change (quote style) + removes now-unneeded eslint-disable comments.
src/util/checksum.ts	Migrates checksum util to TS with explicit types.
src/util/bignumber.js	Formatting change (quote style).
src/transaction_builder.js	Formatting change (quote style) + string literal normalization.
src/transaction_base.js	Formatting change (quote style) + string literal normalization.
src/transaction.js	Formatting change (quote style) + string literal normalization.
src/sorobandata_builder.js	Formatting change (quote style) + string literal normalization.
src/soroban.js	Formatting change (quote style) + string literal normalization.
src/signing.js	Formatting change (quote style).
src/signerkey.js	Formatting change (quote style) + string literal normalization.
src/scval.js	Formatting change (quote style) + string literal normalization.
src/operations/set_trustline_flags.js	Formatting change (quote style) + string literal normalization.
src/operations/set_options.js	Formatting change (quote style) + removes/relocates eslint directives.
src/operations/revoke_sponsorship.js	Formatting change (quote style) + string literal normalization.
src/operations/restore_footprint.js	Formatting change (quote style).
src/operations/payment.js	Formatting change (quote style) + string literal normalization.
src/operations/path_payment_strict_send.js	Formatting change (quote style) + string literal normalization.
src/operations/path_payment_strict_receive.js	Formatting change (quote style) + string literal normalization.
src/operations/manage_sell_offer.js	Formatting change (quote style) + string literal normalization.
src/operations/manage_data.js	Formatting change (quote style) + string literal normalization.
src/operations/manage_buy_offer.js	Formatting change (quote style) + string literal normalization.
src/operations/liquidity_pool_withdraw.js	Formatting change (quote style) + string literal normalization.
src/operations/liquidity_pool_deposit.js	Formatting change (quote style) + string literal normalization.
src/operations/invoke_host_function.js	Formatting change (quote style) + string literal normalization.
src/operations/inflation.js	Formatting change (quote style).
src/operations/index.js	Formatting change (quote style) for exports.
src/operations/extend_footprint_ttl.js	Formatting change (quote style) + string literal normalization.
src/operations/end_sponsoring_future_reserves.js	Formatting change (quote style).
src/operations/create_passive_sell_offer.js	Formatting change (quote style) + string literal normalization.
src/operations/create_claimable_balance.js	Formatting change (quote style) + string literal normalization.
src/operations/create_account.js	Formatting change (quote style) + string literal normalization.
src/operations/clawback_claimable_balance.js	Formatting change (quote style) + string literal normalization.
src/operations/clawback.js	Formatting change (quote style) + string literal normalization.
src/operations/claim_claimable_balance.js	Formatting change (quote style) + string literal normalization.
src/operations/change_trust.js	Formatting change (quote style) + string literal normalization.
src/operations/bump_sequence.js	Formatting change (quote style) + string literal normalization.
src/operations/begin_sponsoring_future_reserves.js	Formatting change (quote style) + string literal normalization.
src/operations/allow_trust.js	Formatting change (quote style) + string literal normalization.
src/operations/account_merge.js	Formatting change (quote style) + string literal normalization.
src/numbers/xdr_large_int.js	Formatting change (quote style) + string literal normalization.
src/numbers/uint256.js	Formatting change (quote style).
src/numbers/uint128.js	Formatting change (quote style).
src/numbers/sc_int.js	Formatting change (quote style) + string literal normalization.
src/numbers/int256.js	Formatting change (quote style).
src/numbers/int128.js	Formatting change (quote style).
src/numbers/index.js	Formatting change (quote style) + string literal normalization.
src/network.js	Formatting change (quote style).
src/muxed_account.js	Formatting change (quote style) + string literal normalization.
src/memo.js	Formatting change (quote style) + string literal normalization.
src/liquidity_pool_id.js	Formatting change (quote style) + string literal normalization.
src/liquidity_pool_asset.js	Formatting change (quote style) + string literal normalization.
src/keypair.js	Formatting change (quote style) + string literal normalization.
src/jsxdr.js	Formatting change (quote style).
src/invocation.js	Formatting change (quote style) + string literal normalization.
src/index.js	Formatting change (quote style) + string literal normalization.
src/hashing.js	Formatting change (quote style).
src/get_liquidity_pool_id.js	Formatting change (quote style) + string literal normalization.
src/fee_bump_transaction.js	Formatting change (quote style) + string literal normalization.
src/events.js	Formatting change (quote style).
src/contract.js	Formatting change (quote style).
src/claimant.js	Formatting change (quote style) + string literal normalization.
src/auth.js	Formatting change (quote style) + string literal normalization.
src/asset.js	Formatting change (quote style) + string literal normalization.
src/address.js	Formatting change (quote style) + string literal normalization.
src/account.js	Formatting change (quote style) + string literal normalization.
package.json	Switches package entrypoints/build/test/lint scripts toward pnpm + tsc CJS build + adds Vitest scripts.
mocharc.tsnode.json	Moves Mocha config out of package.json into a dedicated file.
examples/signing-data.js	Formatting change (quote style).
config/webpack.config.browser.js	Updates browser build pipeline to optionally support TS entrypoints and TS transpilation.
config/prettier.config.cjs	Updates Prettier settings (notably singleQuote: false).
config/karma.conf.js	Updates Karma config for pnpm + explicit plugin requires + new browser test helper.
config/eslint.config.cjs	Introduces ESLint v9 flat config (JS + TS).
config/.eslintrc.js	Removes legacy ESLint config in favor of flat config.
README.md	Updates docs to reference pnpm and reflows warning sections.
CONTRIBUTING.md	Updates contributor docs to reference pnpm and reflows content.
.github/workflows/tests.yml	Updates CI to install/use pnpm and run pnpm scripts.
.github/workflows/npm_publish.yml	Updates publish workflow to install/use pnpm and run pnpm scripts.
.github/workflows/gh_pages.yml	Updates GH Pages workflow to install/use pnpm and run pnpm scripts.
.github/workflows/format.yml	Updates formatting workflow to install/use pnpm and run pnpm scripts.
.github/workflows/bundle_size.yml	Updates bundle size workflow to install/use pnpm and run pnpm scripts.
.github/ISSUE_TEMPLATE/bug_report.md	Updates issue template to reference pnpm lockfile.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Ryang-21]

I believe the workflow checks are failing because I initially had this PR merge into master and it still thinks that after fixing and rerunning

[quietbits]

It's a good start! Let's close this PR and open a new one to make sure all the checks pass. It would be helpful to add comments about config changes and any steps we would need to take and why.

[quietbits]

Why are we removing these?

[Ryang-21]

The previous eslint config used a stricter rule set

[quietbits]

Do we need to create these manually for every file we migrate?

[Ryang-21]

This is generated by tsc

[quietbits]

We'll have mixed JS and TS files for a while, is it OK to disable it?

[Ryang-21]

I chose to disable this so that it would be easier to review the generation type declaration files. With this flag set to true the tsc compiler will generate declaration files for all js files.