TeamCity Unauth RCE Makes Rotation the Job, Not the Patch

The precondition nobody puts in the headline

One detail carries this whole project: Bun's test suite is written in TypeScript. It asserts runtime behaviour, not internals, so it does not care whether the runtime underneath is Zig or Rust. The exact same suite graded both builds. The port itself was mechanical, with the minimum number of behavioural changes, and Sumner wrote a migration plan and style guide before any agent ran.

Invert that and the method collapses. Tests written in the service's own language, mocking concrete internal types, give you no oracle for a port. The ask becomes rewriting the implementation and the verification at the same time, then trusting the output. That is hoping, not engineering. Cheap diagnostic for any repo: score the top three services on black-box contract coverage against white-box unit coupling, then ask whether the suite would still be valid if the implementation language changed.

What the 15/85 split actually budgets

Translation was about 15% of elapsed time. Compiling, fixing tests and verifying correctness was the other 85%. Thariq Shihipar reports the same shape independently: few tokens go to implementation, most go to discovery, prototyping, mocking, verification and testing. Read it as a capacity plan. Sixty-four agents each run compile-and-test loops, so CI becomes the rate limiter and flake rate turns into an active hazard. A nondeterministic test teaches an agent to contort correct code until the assertion goes green.

The gates that make unreadable code mergeable

Sumner's operating question was how to merge 100+ PRs a day and know the code works. The pipeline is the transplantable part:

1. Issue filed, an agent attempts reproduction; if it reproduces, a second container attempts a fix.
2. A mandatory test that fails on the current build and passes with the patch, written before the PR may open.
3. No test means auto-reject. No exceptions, no human negotiation.
4. Linters, then two independent reviewers, Claude review and CodeRabbit, then agents argue on the thread.
5. Human merge once gates are green.

Steps 2 and 3 cost CI minutes rather than tokens, and they hit the precise failure mode of high-volume machine output. Cheapest item on the list. Adopt it first.

Where the evidence is thinner than the story

Two caveats. The $165,000 token figure is being actively questioned in public, which is useful signal by itself, because headline engineering-cost claims are now getting audited. And much of Bun's repository activity is, in the author's phrase, "Claude talking to Claude." The same model family writes the code, the tests, the fuzzers and the review. Correlated blind spots, textbook. Running CodeRabbit next to Claude review reads as deliberate decorrelation. A language port also has a free independent oracle sitting right there: differential fuzzing against the old binary. Same inputs, both implementations, diff the outputs. The legacy Zig build is the one oracle no model authored.

What did not compress

The same reporting covers Claude Managed Agents: six months against a pre-AI estimate of roughly two years. The head of engineering names planning as the single biggest element, in a process that "looked more like a typical pre-AI planning process," Google Doc PRD included. Execution compressed roughly 4x. Cross-org alignment across a sandboxing team and three cloud providers did not. The filter that survives all of this: run the 64-agent play on work that would otherwise never get done at all.

Cheap code generation moves the bottleneck into CI, and what decides throughput after that is whether the test suite can be trusted without being read.

The version number is not the problem; the dependency graph is

Accurate model: anything in your toolchain that imports the TypeScript compiler API is a hard pin to TypeScript 6. TS 7's Go compiler drops direct compiler API access and replaces it with a new LSP language server. Microsoft externalised the coordination cost onto downstream framework maintainers. Vue, Astro and Svelte tooling all reach into that API today.

The unglamorous failure mode is a caret range on typescript in a workspace whose framework plugin touches the compiler. TS 7 lands inside that range. The build breaks with an error that points nowhere useful. Pinning explicitly is cheap now and painful later.

Check what the benchmark actually was: VS Code's own 1.3-million-line codebase, with real pathological types, not a synthetic suite. The number is credible. Its availability to you is conditional.

The cheaper CI win that shipped quietly alongside it

Type-aware linting is usually the longest single step in a TypeScript monorepo's pipeline. It requires a full type-check, so you pay for tsc twice. Oxlint's type-aware linting is stable, which matches the one capability that justified typescript-eslint's cost. The incumbent's remaining moat is plugin ecosystem breadth, not capability.

Do not plan a cutover. Plan a parallel run. Oxlint in report-only mode alongside the existing config, then diff both the findings and the wall-clock. The steady state is two linters, Oxlint for the hot path and ESLint for the long tail of custom org rules, and that is fine. It is still a large net win. It is the highest ratio of CI time saved to engineering effort available in this ecosystem.

Two security items

React shipped 19.0.8, 19.1.9 and 19.2.8 to patch a denial-of-service in server function endpoints. Three simultaneous backports means exposure spans the whole 19.x line. Patch, then confirm that server function routes are rate-limited at the edge. A DoS patch with no rate limit is one fix short. Nuxt shipped 4.5.1 and 3.21.10 as security patches a week after 4.5, which is the textbook argument against being first to adopt any x.y.0.

Separately, Matteo Collina of Node.js core published the argument that prototype pollution cannot be hardened at the runtime level. That reclassifies a whole vulnerability class from "wait for a Node patch" to permanent application-layer responsibility. Three concrete moves follow: schema-validate at the edge instead of deep-merging request bodies, use Object.create(null) for any user-keyed lookup map or config bag, and test --disable-proto in a staging container. The recursive config merge is the canonical sink. A targeted grep usually finds it.

The trade-off the celebration skips

Native rewrites have reached the type checker itself, alongside Rspack, Biome, Turbopack, Bun and Oxlint. Most of it is genuinely good engineering. The cost is narrower, more sanctioned extension surfaces and a smaller pool of people who can fix your bug. The TS 7 LSP boundary is that trade-off, made explicit and paid for by framework maintainers. The selection rule that holds: native for hot paths you consume but never extend, escape hatches preserved wherever custom rules, transforms or AST access are required.

Speed is table stakes in this toolchain now. Extensibility is the scarce resource, and TypeScript 7 prices it explicitly.