deps(npm): bump @humanfs/node from 0.16.7 to 0.16.8 in /frontend/taskdeck-web

[dependabot]

Bumps @humanfs/node from 0.16.7 to 0.16.8.

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

• Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

Commits

• e96070e chore: release main (#146)
• 22bbaa4 Merge commit from fork
• 956ce7a fix: Include type dependencies at runtime
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Chris0Jeky]

Independent review, because this PR had received none. Neither this nor #2407 got a Codex review or any other, so law 2's gate was unmet on both; one fresh-context read-only pass covered them together.

Verdict: CLEAR. No CRITICAL or HIGH.

Not a security update

Unlike #2407, this is a plain bug-fix bump. The 0.16.8 release notes cover "Include type dependencies at runtime" (upstream issue #145) and symlink handling in copy()/copyAll(). No advisory is referenced, so the security triage checklist in docs/ops/DEPENDENCY_UPDATE_POLICY.md does not apply here.

Exposure: dev-only, entirely under ESLint

• @humanfs/types@0.15.0 is genuinely new to this tree; it appears nowhere in the current lockfile.
• The only consumer of @humanfs/node is node_modules/eslint (10.9.1, "dev": true) at ^0.16.6, which 0.16.8 satisfies. eslint is in devDependencies (frontend/taskdeck-web/package.json:84), not dependencies.
• The only consumer of @humanfs/core is @humanfs/node. Post-merge ^0.19.2 resolves to 0.19.2, and ^0.15.0 resolves to the added 0.15.0.
• Every @humanfs/* entry carries a plain "dev": true. That is npm's own computation, not an inference: the lockfile does distinguish, marking devOptional where it applies. There is no non-dev path, so nothing here can reach the shipped bundle.
• The new package is Apache-2.0, engines: node >=18.18.0, consistent with the rest of the subtree. The frontend SBOM builds with --omit dev, so it does not enter the SBOM either.

Rebase needed

#2407 merged first, so this branch is now behind and both PRs touched frontend/taskdeck-web/package-lock.json. The two diffs are in disjoint regions (this one around the @humanfs/* entries, #2407's at the browserslist and fast-uri entries), so the merge is textually clean and the combined lockfile stays internally consistent, with every declared range resolving to a present entry.

Rebasing produces a new head, so ci-required must be green on that head and the post-push aging window restarts before merge. Per .claude/rules/ci-control.md, refresh with gh pr update-branch rather than gh run rerun, because a rerun reuses the stale merge ref. package-lock.json is a control path in ci/policy.v1.json, so the hosted exact-head run is the proving check; a local npm ci is not the gate.

This review stands for the rebased head as well: the delta from the rebase is #2407's already-reviewed and already-merged content in a disjoint region of the same file, touching nothing this PR owns, so law 2 owes no fresh round for it.

Not verified: no build or install was run. The dependency-path analysis is from the lockfile and package.json only. Hosted CI runs the full frontend install, typecheck, build and test lanes.