Merge remote-tracking branch 'upstream/main' into preserve-inferred-ata

# Conflicts:
#	tsc/internal/project/project.go
#	tsc/internal/project/projectcollection.go
#	tsc/internal/project/projectcollectionbuilder.go
#	tsc/internal/project/session.go

Author: jakebailey

.dprint.jsonc

@@ -48,8 +48,8 @@
         "**/testdata",
         "packages/vscode-typescript/l10n/**",
         "tsc/internal/bundled/libs/**",
-        "tsc/internal/lsp/lsproto/_generate/*.json",
-        "tsc/internal/lsp/lsproto/_generate/metaModelSchema.mts",
+        "tools/scripts/lsp/*.json",
+        "tools/scripts/lsp/metaModelSchema.mts",
         // Needs to be LF to have a working shebang.
         "packages/typescript/bin/tsc",
         "tsc/internal/bundled/source/**",

.github/actions/setup-go/action.yml

@@ -15,3 +15,9 @@ runs:
         go-version: ${{ inputs.go-version }}
         go-download-base-url: https://aka.ms/golang/release/latest
         cache: false
+
+    - name: Cache Go modules
+      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      with:
+        path: ~/go/pkg/mod
+        key: go-modules-${{ github.workflow }}-${{ github.job }}-${{ runner.os }}-${{ inputs.go-version }}-${{ hashFiles('**/go.mod', '**/go.sum', 'go.work', 'go.work.sum', '.custom-gcl.yml') }}

.github/skills/api-client/SKILL.md

@@ -34,3 +34,21 @@ If the method is an operation on a single `Type` or `Symbol` that takes no other
 ## Unnecessary spread and `exactOptionalPropertyTypes`
 
 Never write code like `...(options ? { snapshot: options.snapshot } : {})`. All optional properties should tolerate `undefined`. If `--exactOptionalPropertyTypes` is forcing you to write code this way, fix the offending type. Rewriting as `if (options) foo.snapshot = options.snapshot` is not an acceptable workaround; always fix the type. As a rule, object types used in input positions should always define optional properties with `prop?: T | undefined` so this isn't a problem.
+
+## What kinds of ID collisions matter?
+
+Most API objects synchronize their client and server identities by some kind of handle or ID. Some care has to be taken when choosing an ID scheme.
+
+What matters:
+
+* A single `api.Session` in LSP mode can have multiple simultaneous clients. Sometimes those clients will all talk about the same server object. Other times, a single client needs to create objects that are private to it, like resolution contexts or source file leases. In those cases, the server must generate the unique ID after creation to avoid ID collision of private objects between multiple clients.
+
+
+What doesn't matter:
+
+* `uint64` overflow
+* Passing objects between multiple `API` instances in the same JS process. We may eventually add some kind of central provenance validation. Do not add it on individual methods or flag it in reviews for now. It's not a realistic concern.
+
+## Reference equality guarantees are forfeited by disposing owners and clearing the source file cache
+
+It's not a bug to observe a new object identity for an object whose owner was previously disposed or manually removed by `api.clearSourceFileCache()`. Review comments and tests that assert an ownership or lifetime bug that rely on testing reference equality after disposal or cache clearing will be rejected.

.github/skills/restack/SKILL.md .github/skills/mcfly/SKILL.md.github/skills/restack/SKILL.md renamed to .github/skills/mcfly/SKILL.md

@@ -1,21 +1,22 @@
 ---
-name: restack
+name: mcfly
 description: Only invoke when explicitly instructed to
 ---
 
 You need to "re-stack" your commits to match the following format:
- * A failing test case
+ * Testcase(s), including at least one that demonstrate the problem - this could be a test that directly fails, baselines that show the problem, or even both
  * A commit, or series of commits, that fixes the failing test case
- * (Optional) a follow-up commit that checks in any modified baselines
+ * If needed, a follow-up commit with modified baselines
 
 Since you can't force-push, start with a commit that undoes all your prior changes and gets you back to `main`.
 
 Then add your test case(s) in a single commit.
+When you add testcases that create or modify baselines, commit the (pre-fix) baselines at the same time as the testcases themselves.
 A test case isn't necessarily a new file; it could be a modification to an existing test or a change in the test configuration.
 Ensure that at least one test in the full run fails - you might be operating on a bad PR that didn't actually introduce a failing scenario!
 If zero tests failed, abort and post a message explaining what you observed.
 Remember that baseline tests do not "fail" in the traditional sense; they are used to verify that the output matches the expected baseline.
-You should examine the PR description to determine what the desired passing baseline should look like.
+Ensure that your test demonstrates the problem that the PR is intended to fix.
 
 Then, add your fix.
 You can break this apart into multiple commits if it's more logical to review that way; use your judgment.
@@ -25,4 +26,4 @@ Do not accept baseline diffs yet!
 
 Finally, if there are baseline diffs, commit those in a separate commit.
 
-Ensure that the final diff you have matches the original diff you started with; this process should not introduce any unintended changes.
+Ensure that the final diff you have matches the original diff you started with, as this process should not introduce any unintended changes.

.github/skills/security-report-check/SKILL.md

@@ -84,6 +84,24 @@ If this file is modified, it can cause `tsc` to e.g. fail to build a file becaus
 The TypeScript Language Service (LS) only executes in the context of a [trusted workspace (VS Code)](https://code.visualstudio.com/docs/editing/workspaces/workspace-trust) or [trusted folder (VS)](https://learn.microsoft.com/en-us/visualstudio/ide/trust-settings?view=visualstudio).
 Similar to tsc, there are no guaranteed resource caps in the LS, and "hangs" may occur in the presence of adversarial inputs.
 
+### Workspace Trust is Your Responsibility
+
+Remember the definition of Workspace Trust (emphasis added):
+
+> The Workspace Trust feature lets you decide whether **code in your project** folder can be **executed** by VS Code and extensions **without your explicit approval**.
+
+Features like Content Mappers, including when they come from `node_modules`, are part of this "code in your project" and will run if you trust a workspace containing them.
+This also includes TypeScript itself if you have enabled using the workspace version of TypeScript (again e.g. from `node_modules`).
+The TypeScript Language Service doesn't provide additional barriers to this execution.
+Remember to only enable Workspace Trust for workspaces that you trust, i.e. are willing to run code from.
+
+### Go Compiler CVEs
+
+The Go compiler is frequently updated to address CVEs in its core components and standard library.
+These normally do not affect TypeScript - for example, a CVE in Go's HTTP library is not reachable from tsc, so is not relevant to TypeScript security.
+We do not issue patch releases of TypeScript to adopt newer versions of Go **unless** there is an identified path to a particular CVE.
+We recommend using `govulncheck` instead of a blanket version-based scan to identify potential issues.
+
 ## Examples
 
 ### Hypothetically Valid Security Reports

.github/workflows/bump-vscode-typescript.yml

@@ -60,6 +60,7 @@ jobs:
           npm version "$BUMP" \
             --workspace native-preview \
             --no-git-tag-version \
+            --package-lock-only
 
           packageVersion="$(jq -r '.version' packages/vscode-typescript/package.json)"
           lockVersion="$(jq -r '.packages["packages/vscode-typescript"].version' package-lock.json)"

.github/workflows/ci.yml

@@ -280,7 +280,6 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 'lts/*'
-      - uses: ./.github/actions/setup-go
       - run: npm ci
       - run: npx hereby check:format
 

.golangci.yml

@@ -68,6 +68,8 @@ linters:
     depguard:
       rules:
         main:
+          files:
+            - '**/tsc/**/*.go'
           deny:
             - pkg: 'encoding/json$'
               desc: 'Use "github.com/microsoft/TypeScript/tsc/internal/json" instead.'