build(deps-dev): bump @types/node from 22.20.4 to 26.6.2

[dependabot]

Bumps @types/node from 22.20.4 to 26.6.2.

Commits

• See full diff in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 23, 2026, 7:49 PM ET / 23:49 UTC (Revision 3).

ClawSweeper review

What this changes

Updates the CLI's development-only Node.js type declarations from version 22 to 26 and refreshes the lockfile references.

Merge readiness

⛔ Blocked before merge - 3 items remain

This update is still absent from current main. It needs a maintainer decision because the repository deliberately uses Node 22 declarations while promising Node 22 runtime support; the proposed major declaration bump removes that compile-time guard.

Priority: P3
Reviewed head: e496e9943058e68d9f972eaa95df356b785501e5
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The dependency update is narrow and checks pass, but its compatibility policy remains unresolved.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored dependency update is exempt from contributor runtime proof; passing Node 22 and 24 checks covers current behavior but does not establish future Node 22 API type protection. No stored-data contract changes.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored dependency update is exempt from contributor runtime proof; passing Node 22 and 24 checks covers current behavior but does not establish future Node 22 API type protection. No stored-data contract changes.
Evidence reviewed	5 items	Introduced dependency change: The pinned PR delta changes @types/node from 22.20.4 to 26.6.2 and updates its lockfile dependency references. Current main and runtime floor: Current main still specifies Node 22 declarations and a Node >=22 runtime floor, so it has not incorporated this update. CI coverage boundary: The main typecheck runs on Node 26; the Node 22 and 24 jobs run tests, build, and package smoke checks. Passing those jobs does not restore a Node 22 declaration check.
Findings	None	None.
Security	None	None.

How this fits together

The TypeScript compiler uses Node declarations to check the CLI source during development. The compiled CLI is then packaged for users running Node 22 or newer.

flowchart LR
  A[CLI source] --> B[Node type declarations]
  B --> C[TypeScript check]
  C --> D[Compiled CLI]
  D --> E[Node 22 and newer users]

Loading

Decision needed

Question	Recommendation
Should the primary typecheck continue to enforce the supported Node 22 API floor, or may it use Node 26 declarations?	Preserve Node 22 guard: Keep the primary declarations aligned with Node 22 while the published CLI supports it.

Why: The merged compatibility work chose Node 22 declarations deliberately; accepting weaker compile-time coverage changes that policy.

Before merge

• Resolve merge risk (P1) - Using Node 26 declarations for the primary typecheck would allow later code to use APIs absent from supported Node 22 installations without a compiler error.
• Complete next step (P2) - Confirm the Node declaration policy; preserve a Node 22 compiler guard before merge unless the maintainer explicitly accepts its removal.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

None.

Merge-risk options

Maintainer options:

1. Retain the Node 22 guard (recommended)
   Keep Node 22 declarations or add an equivalent Node 22 compiler check before merging this major update.
2. Accept runtime-only coverage
   A maintainer can explicitly accept that future unsupported Node API calls may pass typechecking.
3. Close this dependency bump
   Leave the current declarations in place if Node 26 typings provide no needed capability.

Technical review

Best possible solution:

Keep Node 22 declarations for the primary build while Node 22 remains supported, or add an explicit Node 22 declaration check if newer typings are needed elsewhere.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction: the source establishes the declaration-floor mismatch, while current Node 22 runtime checks pass.

Is this the best way to solve the issue?

No. A direct Node 26 typings bump weakens the existing compatibility guard; retaining a Node 22 compiler check is the safer path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3bc92bffc55a.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is a development dependency update without a demonstrated current user-facing failure.
• merge-risk: 🚨 compatibility: The major typings bump weakens compile-time protection for the declared Node 22 runtime floor.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored dependency update is exempt from contributor runtime proof; passing Node 22 and 24 checks covers current behavior but does not establish future Node 22 API type protection. No stored-data contract changes.

Evidence

What I checked:

• Introduced dependency change: The pinned PR delta changes @types/node from 22.20.4 to 26.6.2 and updates its lockfile dependency references. (package.json:44, e496e9943058)
• Current main and runtime floor: Current main still specifies Node 22 declarations and a Node >=22 runtime floor, so it has not incorporated this update. (package.json:44, 3bc92bffc55a)
• CI coverage boundary: The main typecheck runs on Node 26; the Node 22 and 24 jobs run tests, build, and package smoke checks. Passing those jobs does not restore a Node 22 declaration check. (.github/workflows/ci.yml:25, e496e9943058)
• Prior support decision: Merged chore: update dependencies and verify supported Node runtimes in CI #209 explicitly aligned typings to Node 22 because the CLI promises Node 22 support; merged build(deps): refresh eligible tooling and security scanners #222 retained Node 22 compatibility and declarations. (b979f94701be)
• Prior review continuity: The prior completed review at the same PR head raised the declaration-floor question as a rank-up move and recorded no line-level finding; the current head has not changed since. (e496e9943058)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Record whether Node declarations must remain aligned with the supported Node 22 floor.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-21T16:10:22.369Z sha 887dd62 :: blocked before merge. :: none
• reviewed 2026-09-22T10:35:30.984Z sha e496e99 :: blocked before merge. :: none

[steipete]

Thanks for the update. Closing this major typings bump to retain the documented Node 22 runtime floor. The build deliberately uses Node 22 declarations; switching to Node 26 declarations would allow newer APIs through typechecking even though supported Node 22 users cannot run them. There is no needed Node 26 API or runtime change in this PR that justifies dropping Node 22/24 support. Node 22 patch updates remain welcome.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.