build(deps-dev): bump @types/node from 26.2.0 to 26.4.0 - #1133
build(deps-dev): bump @types/node from 26.2.0 to 26.4.0#1133dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.2.0 to 26.4.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact head 3f16708767ad8ac11e675e170c622d24d09332d8 repeats the canonical npm-lock provenance defect already demonstrated on #1134: the dependency bump also removes peer: true from the root node_modules/@esbuild/* records. That violates #896's repository-owned npm 10.9.9 lock-generation contract and the explicit peer-metadata regressions. Preserve the @types/node update, but regenerate the complete lock with the repository-canonical npm 10.9.9 against current protected ancestry, then require frozen npm ci, the two lock/provenance regressions, and full quickcheck on the same exact head. Do not hand-edit the lock or weaken the tests.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact head 3f16708767ad8ac11e675e170c622d24d09332d8 has a reproducible repository-owned RED, so this dependency update must remain unmerged. ci run 33589595580 / job 100266058867 fails quickcheck in exactly two lock-provenance regressions: test_lock_records_match_exact_registry_artifacts_and_preserve_peer_metadata and test_root_lock_preserves_esbuild_peer_metadata. The generated package-lock.json stripped peer: true from root node_modules/@esbuild/* records (the first reported example is node_modules/@esbuild/aix-ppc64). The manifest bump itself is not the finding; the lock artifact is.
Repair this through the canonical npm/jsdom lock-generation owner #896 (or a verified successor) using the repository-pinned npm 10.9.9 toolchain and a complete regenerated lock. Preserve the @esbuild/* peer metadata and the existing security/provenance contracts, then rerun exact-head CI/release. Do not hand-edit the lock, weaken either regression, or close this PR until its unique @types/node 26.4.0 delta is fully integrated and verified elsewhere.
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
Dependency-only bump of devDependency @types/node from ^26.1.1 to ^26.4.0 in apps/desktop and packages/shared-types, with consistent lockfile updates. Lockfile also removes 'peer': true flags from optional platform binaries, which is a non-functional normalization. No source or test changes, and no blocking issues identified.
Reviewed changed lines
apps/desktop/package.json:36 (RIGHT): Version range for @types/node updated from ^26.1.1 to ^26.4.0. Consistent with package-lock.json resolved version 26.4.0.packages/shared-types/package.json:12 (RIGHT): Version range for @types/node updated from ^26.1.1 to ^26.4.0. Consistent with package-lock.json resolved version 26.4.0.package-lock.json:3546 (RIGHT): Resolved @types/node version updated to 26.4.0 with matching resolved URL and integrity hash. No version mismatch with workspace manifests.
Adversarial validation
apps/desktop/package.json:36 (RIGHT)falsified: The @types/node bump from 26.2.0 to 26.4.0 could introduce breaking type changes that break the TypeScript typecheck. — Both package.json files specify ^26.4.0, the lockfile resolves to 26.4.0 with matching integrity, and the update is a minor/patch bump with no known breaking type changes. CI runs 'typecheck' and would catch any type incompatibilities.package-lock.json:3546 (RIGHT)falsified: The lockfile changes, including removal of 'peer': true flags from optional platform binaries, could cause dependency resolution or runtime behavioral regressions. — The peer flag removals affect only optional platform-specific binary packages and are a recognized npm lockfile normalization; they do not change resolution or runtime behavior. The @types/node entry and workspace manifests are all consistent at version 26.4.0.- Residual risk: Minor residual risk that future type definitions in @types/node 26.4.0 could reveal type errors not caught in this review, but mitigated by CI typecheck jobs.
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
3f16708767ad8ac11e675e170c622d24d09332d8 - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
1 participant
Bumps @types/node from 26.2.0 to 26.4.0.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)