[yunus-dev-codecrafter]

closes #235
Pin @types/node to the Node 22 type line (22.20.5) so development-time types match the engines floor of Node >=22.13.0 <25. Compiling against the oldest supported Node major prevents accidental use of runtime APIs unavailable on Node 22.

Regenerate package-lock.json (undici-types 7.24.6 -> 6.21.0) and configure Dependabot to ignore @types/node major updates so unsupported Node type majors cannot be reintroduced while the engine range is unchanged. Document the compatibility rationale in the dependency policy.

Refs #235

Summary

Align the development-time Node.js type definitions with StellarForge CLI's supported runtime contract.

The package engine range is Node.js >=22.13.0 <25, but @types/node was on major 25 — types for a Node major outside the supported range. This PR pins @types/node to the current supported Node 22 type line (22.20.5), regenerates package-lock.json consistently, configures Dependabot so it cannot reintroduce Node type majors outside the supported runtime range, and documents the compatibility rationale in the dependency policy.

Related Issue

Closes #235

Scope

Work completed:

• pin @types/node to the current supported Node 22 type line (22.20.5);
• update package-lock.json consistently (only @types/node 25.9.8 -> 22.20.5 and its transitive undici-types 7.24.6 -> 6.21.0);
• configure Dependabot (.github/dependabot.yml) to ignore @types/node major updates so unsupported Node type majors cannot be reintroduced while the engine range is unchanged;
• document the compatibility rationale in docs/contributing/dependency-policy.md.

Intentionally left out (out of scope):

• adding Node 25 runtime support;
• changing the npm publishing workflow;
• broad dependency upgrades;
• unrelated lockfile refreshes.

The supported Node runtime range (>=22.13.0 <25) is not changed in this PR.

Testing

Checks run:

• Tests added/updated where applicable
• Existing relevant tests pass
• Lint/type/build checks pass where available

Results:

• npm ci --ignore-scripts --no-audit --no-fund — succeeded (168 packages).
• npm run typecheck — passed (confirms @types/node@22.20.5 compiles cleanly under TypeScript 6.0.3).
• npm run lint — passed.
• npm run format:check — passed.
• npm run build — passed.
• npm test — 159/161 passed. The 2 failures (tests/configuration.test.ts, tests/template-generation.test.ts) are EPERM: operation not permitted, symlink errors caused by local Windows symlink privileges (Developer Mode/Administrator). These fail identically on the untouched main baseline, so they are pre-existing/environmental and unrelated to this type-only change; they pass on elevated CI runners.

Security Impact

• No security-sensitive behavior is changed
• Security-sensitive behavior is changed and explained below

Security notes: this is a development-dependency and dependency-automation change only. No runtime dependency, public CLI behavior, or trust boundary is affected. Keeping the development-time types aligned with the oldest supported runtime reduces the risk of shipping code that relies on APIs unavailable at runtime.

Release Impact

• No published/user-visible behavior change

• Patch

• Minor

• Breaking/pre-1.0 contract change

• Changeset included where required

• Changeset not required; reason explained below

Release notes: no published/user-visible behavior changes. This touches only a development dependency, the lockfile, Dependabot configuration, and documentation. No Changeset is expected.

Documentation

• Documentation updated where applicable
• No documentation change required

Checklist

• I read docs/contributing/wave-architecture.md for Stellar Wave work
• I stayed within the agreed issue scope
• I checked for overlapping open contributor PRs
• I did not include secrets or sensitive data
• I reviewed new/updated dependencies if any
• I considered failure/error paths, not only the happy path
• I am not disclosing an unresolved vulnerability publicly

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: eb4fd72d-33fe-4e3c-9df6-7e69fe5e5cd7

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}