Skip to content

chore(deps): bump @types/node from 22.20.1 to 26.5.0 - #437

Closed
dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/types/node-26.4.0
Closed

dependabot[bot] wants to merge 1 commit into
developmentfrom
dependabot/npm_and_yarn/types/node-26.4.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •

Copy link
Copy Markdown

Bumps @types/node from 22.20.1 to 26.5.0.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.20.1 to 26.5.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.4.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump @types/node from 22.20.1 to 26.4.0 chore(deps): bump @types/node from 22.20.1 to 26.5.0 Sep 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/types/node-26.4.0 branch from 2e72fb3 to 493d84b Compare September 10, 2026 21:27
@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 8b56be51-3b08-4e48-9859-5da91d9241b3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

mohanagy added a commit that referenced this pull request Sep 11, 2026
Vitest 5 applies AST-aware remapping unconditionally, attributing functions
and branches differently from Vitest 3. With identical tests and unchanged
source, the measured figures moved in both directions — upstream-process-manager
functions 100 -> 89.84 and redact branches 94.69 -> 87.17, but
secret-provider-availability branches 81.57 -> 84.21 and secret-resolver
functions 86.66 -> 89.47 — so this is a measurement change, not a coverage
regression. Confirmed by running coverage on development (Vitest 3), where the
same tests meet every threshold.

Vitest 5 removed the experimental opt-out, so the previous measurement cannot
be restored. Recalibrated the seven breached function and branch thresholds to
measured actuals with a small margin, preserving the ratchet going forward.
Line thresholds were unaffected and are unchanged.

Refs #435, #436, #437, #438, #445

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
mohanagy added a commit that referenced this pull request Sep 11, 2026
Supersedes #445, #438, #437, #436, #435, none of which could go green alone.

Vitest 3.2.7 -> 5.0.0 with @vitest/coverage-v8 and vite as an explicit devDependency (Vitest 5 declares vite a non-optional peer). @types/node 22 -> 26, @hono/node-server 2.0.10 -> 2.1.1, esbuild 0.28.1 -> 0.28.2, eslint 10.8.0 -> 10.10.0, typescript-eslint 8.65.0 -> 8.70.0. Both the production-only and full npm audits now report zero.

@types/node 26 added a throwIfNoEntry overload to stat(), so Awaited<ReturnType<typeof stat>> resolves to Stats | BigIntStats | undefined and keyof of that union is never. Replaced the idiom with the concrete Stats type in the three files using it.

Vitest 4 removed test.poolOptions and promoted its contents to top-level options. Vitest 5 applies AST-aware remapping unconditionally, so function and branch figures are not comparable across the migration; thresholds recalibrated to measured actuals with line thresholds unchanged.

zod 4.2.0 -> 4.6.2 deliberately held: the evidence-pinned bundled fixture embeds zod, so bumping it invalidates the sha256 that the named-host evidence ledger pins. Lock-only hold; the declared ^4.2.0 range is unchanged.

Refs #435, #436, #437, #438, #445

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mohanagy

Copy link
Copy Markdown
Owner

Superseded by #446, which landed this bump together with the changes Dependabot cannot make on its own.

This PR could not pass alone: see #446 for the specific reason (split vitest peer pair, security-override contract pins, or @types/node 26 source breakage) and the verification.

@mohanagy mohanagy closed this Sep 11, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 11, 2026

Copy link
Copy Markdown
Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/types/node-26.4.0 branch September 11, 2026 04:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant