
Security News
NIST Officially Stops Enriching Most CVEs as Vulnerability Volume Skyrockets
NIST will stop enriching most CVEs under a new risk-based model, narrowing the NVD's scope as vulnerability submissions continue to surge.
TypeScript 6.0 introduces new standard APIs, modern default settings, and deprecations as it prepares projects for the upcoming TypeScript 7.0 release.

March 23, 2026
3 min read


TypeScript 6.0 landed today marking a milestone: this is the final release built on the existing JavaScript codebase. TypeScript 7.0, currently in preview, will run on a Go-native compiler, and the team says the release is imminent.
"TypeScript 6.0 acts as the bridge between TypeScript 5.9 and 7.0," Microsoft's TypeScript Principal Product Manager Daniel Rosenwasser said. "As such, most changes in TypeScript 6.0 are meant to help align and prepare for adopting TypeScript 7.0. It may seem surprising to say, but TypeScript 7.0 is actually extremely close to completion."
The release introduces several new standard library APIs, a defaults overhaul that will touch nearly every project, and a deprecation sweep clearing out a decade of legacy options before 7.0 lands.
TypeScript 6.0 adds types for several TC39 Stage 4 proposals, aligning the standard library with recently finalized JavaScript features.
Temporal global is now included in esnext.getOrInsert and getOrInsertComputed methods on Map and WeakMap eliminate the boilerplate of checking for keys before setting defaults.#/): TypeScript 6.0 now supports Node.js-style #/ prefixes for package-internal imports under nodenext and bundler resolution modes.Version 6.0 ships with several defaults that will likely require tsconfig.json updates immediately upon installation. The release introduces a significantly stricter and more modern JavaScript baseline by default, while cutting several legacy behaviors to improve build performance.
types: [] by default: This is one of the most impactful changes and a likely source of breakage. TS no longer crawls node_modules/@types by default. You must now explicitly list your globals (e.g., ["node", "jest"]). This can cut cold build times by up to 50%.strict: now defaults to true, making strict mode the baseline for new projects.rootDir defaults to .: It no longer infers the common source directory. If your tsconfig.json isn't in your source root, you’ll need to set this explicitly to avoid nested output structures (like dist/src/index.js).module defaults to esnexttarget defaults to current ES version (es2025)To make the upcoming Go-based compiler as fast as possible, several legacy features are being phased out. These deprecations can be temporarily suppressed with "ignoreDeprecations": "6.0", but will be removed in TypeScript 7.0.
baseUrl: Deprecated. Path mappings no longer require it, and it is no longer treated as a resolution root.target: ES5: Support for ES5 as a compilation target has been deprecated; the minimum supported version is now ES2015. If you need ES5, you’ll need a post-processor like Babel or esbuild.module namespaces: Using module Foo { ... } is now a hard error. Use namespace Foo { ... }.outFile: The option has been removed in favor of external bundlers like esbuild, Rollup, and Webpack.moduleResolution: node: Deprecated. Projects should migrate to nodenext (for Node.js) or bundler (for bundler-based setups), which reflect modern module resolution behavior.The Go-native TypeScript 7.0 compiler is already available in VS Code preview and on npm. TypeScript 6.0 includes a --stableTypeOrdering flag to help surface behavioral differences between the two compilers, matching 6.0's type ordering to 7.0's deterministic algorithm (at the cost of up to 25% slower type-checking). It's meant to be used as a diagnostic tool to assist with 6.0-to-7.0 migrations.
Rosenwasser said his team expects a release of TypeScript 7.0 within a few months, and they are "already seeing broad adoption inside and outside of Microsoft on extremely large codebases."
The team is currently seeking feedback on these default shifts and the performance impact of the new types resolution via the TypeScript issue tracker as they move toward the final 7.0 stabilization.

Subscribe to our newsletter
Get notified when we publish new security blog posts!

Security News
NIST will stop enriching most CVEs under a new risk-based model, narrowing the NVD's scope as vulnerability submissions continue to surge.

Company News
/Security News
Socket is an initial recipient of OpenAI's Cybersecurity Grant Program, which commits $10M in API credits to defenders securing open source software.

Security News
Socket CEO Feross Aboukhadijeh joins 10 Minutes or Less, a podcast by Ali Rohde, to discuss the recent surge in open source supply chain attacks.