chore(deps)(deps-dev): bump @types/node from 24.13.3 to 26.1.1 - #374
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps)(deps-dev): bump @types/node from 24.13.3 to 26.1.1#374dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 24.13.3 to 26.1.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
the
dependencies
pathosDev
added a commit
that referenced
this pull request
Jul 22, 2026
…| v13 Bump the better-sqlite3 dev dependency 12.11.1 -> 13.0.1 and widen the optional peer range from ^12.9.0 to ^12.9.0 || ^13.0.0 so the two stay consistent — Dependabot's #376 only bumped the devDependency, which would have left the peer range excluding the very version we test against. better-sqlite3 13 migrated to Node-API: its old prebuild-install / bindings / file-uri-to-path native-binding dependency tree is replaced by node-addon-api, which improves prebuilt-binary portability across Node versions. The BetterSqliteDriver surface (open/exec/prepare/run/get/all/transaction/close) is unchanged, so no consumer migration is required. Ran `bun install` to sync bun.lock; as in the neighbouring commit it also reconciles the stale package.json range mirror (fastify, hono, @fastify/*, fast-check, and @types/node's ^24.0.0 -> ^24.13.3) — no resolved versions change beyond the better-sqlite3 subtree. @types/node stays pinned to the v24 support floor per the documented decision in this release's CHANGELOG; #374's bump to 26 was deliberately not taken. Refs #376 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
pathosDev
added a commit
that referenced
this pull request
Jul 22, 2026
Dependency maintenance from the three open Dependabot PRs, reworked to fit the repo workflow and verification gates: - brace-expansion 5.0.5 -> 5.0.7 in the two Angular example frontends — surgical security patch; #375's bundled unrelated lockfile drift (Angular 21->22, @InQuirer, svelte/vite, ...) was dropped. Refs #375 - better-sqlite3 12.11.1 -> 13.0.1 with the optional peer range widened to ^12.9.0 || ^13.0.0; bun.lock synced. The Node driver path (which no CI check exercises) was verified against v13. Refs #376 #374 (@types/node -> 26) was deliberately NOT taken: the [Unreleased] CHANGELOG pins @types/node to the v24 support floor on purpose, so that framework code cannot accidentally use Node-26-only APIs. Running `bun install` also reconciled bun.lock's stale package.json range mirror, which unblocks the Docker `integration` frozen-lockfile check that both dependency PRs were failing.
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This was referenced Aug 4, 2026
pathosDev
added a commit
that referenced
this pull request
Aug 5, 2026
`@types/node` tracks the `engines` support floor (24) on purpose, not latest, so a newer-Node API cannot slip into the tree unnoticed — `ac552d5b` states it outright and multi-runtime.yml pins its Node leg to the same 24 for the same reason. Dependabot has no way to know that, so it re-opens the major bump every release cycle: #334, #336 and #374 were closed, #340 briefly landed on 26.1.0 before `ac552d5b` rolled it back, and #481 is the fourth reopening of a settled decision. What makes this worth a config rule rather than another close: the pin is load-bearing precisely where nothing observes it. With #481 applied locally and `bun.lock` synced, `bun run typecheck` passes and `bun test` reports 3544 pass / 0 fail across 296 files — every gate green. It cannot be otherwise, since the pin's job is to make the offending APIs unrepresentable at compile time rather than to fail a test. Compiling the same file against both type majors shows what it buys: `@types/node` 26 declares whole modules Node 24 does not have (`node:quic`, `node:ffi`) plus additions like `util.convertProcessSignalToExitCode`; under 24 that file is two compile errors, under 26 it is clean and would ship code that crashes on the runtime floor we advertise. Minor and patch updates inside the pinned major keep flowing. When the floor is raised deliberately, the pin and this rule move together, the way they did in `ac552d5b`. Closes #906
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @types/node from 24.13.3 to 26.1.1.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)