From 9127319c5e42dad4069c82863480f63912731a5c Mon Sep 17 00:00:00 2001 From: yunus-dev-codecrafter Date: Sat, 17 Oct 2026 10:13:07 +0100 Subject: [PATCH] ci: align @types/node with supported Node 22 runtime Pin @types/node to the Node 22 type line (22.20.5) so development-time types match the engines floor of Node >=22.13.0 <25. Compiling against the oldest supported Node major prevents accidental use of runtime APIs unavailable on Node 22. Regenerate package-lock.json (undici-types 7.24.6 -> 6.21.0) and configure Dependabot to ignore @types/node major updates so unsupported Node type majors cannot be reintroduced while the engine range is unchanged. Document the compatibility rationale in the dependency policy. Refs #235 --- .github/dependabot.yml | 4 ++++ docs/contributing/dependency-policy.md | 10 ++++++++++ package-lock.json | 16 ++++++++-------- package.json | 2 +- 4 files changed, 23 insertions(+), 9 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 307beae..8fe760b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,6 +14,10 @@ updates: update-types: - minor - patch + ignore: + - dependency-name: '@types/node' + update-types: + - version-update:semver-major - package-ecosystem: github-actions directory: / diff --git a/docs/contributing/dependency-policy.md b/docs/contributing/dependency-policy.md index 1f2b619..771e773 100644 --- a/docs/contributing/dependency-policy.md +++ b/docs/contributing/dependency-policy.md @@ -45,6 +45,16 @@ Checks run weekly. Compatible minor and patch updates are grouped to reduce pull Dependabot pull requests must pass the same CI/security checks as contributor pull requests and remain subject to maintainer review. No auto-merge policy is enabled by this configuration. +### Node.js type definitions and the supported runtime + +The package engine range is `Node.js >=22.13.0 <25`. The `@types/node` development dependency is intentionally pinned to the **current supported Node 22 type line** rather than the newest available major. + +Type definitions describe which Node.js APIs are available. Compiling against the types for the **oldest supported Node major** means the compiler rejects APIs that do not exist in that runtime. If development instead compiled against a newer major's types, code could pass typechecking and CI while still crashing for users on the engine floor (Node 22.13.0). Pinning to the floor is therefore the conservative choice that protects compatibility across the whole supported range. + +To keep that guarantee stable, Dependabot ignores **major** updates for `@types/node` (`update-types: version-update:semver-major`). Compatible minor and patch updates within the Node 22 type line remain eligible. This prevents Dependabot from reintroducing a Node type major outside the supported runtime range while the engine range is unchanged. + +If the engine floor or range is ever changed, revisit both the `@types/node` pin and this Dependabot ignore rule together so the type line continues to track the oldest supported major. + ## Updates Prefer small, reviewable dependency updates. Major upgrades should document compatibility impact and include relevant tests. When an urgent security update conflicts with normal grouping or cadence, prioritize the security fix in a focused pull request rather than waiting for the next scheduled version-update run. diff --git a/package-lock.json b/package-lock.json index 5f05f46..88efca4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -17,7 +17,7 @@ "devDependencies": { "@changesets/cli": "3.0.3", "@eslint/js": "10.0.1", - "@types/node": "25.9.8", + "@types/node": "22.20.5", "eslint": "10.11.0", "prettier": "3.9.8", "typescript": "6.0.3", @@ -984,13 +984,13 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "25.9.8", - "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.8.tgz", - "integrity": "sha512-VfMrScDmMhUJQmd5hArdQnFvK0OIeD36uN2Va1FcpYaLB/BgkgM8Ulc50XtYISPMz7APJ30+N0T5EM0jlcdfRw==", + "version": "22.20.5", + "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz", + "integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==", "dev": true, "license": "MIT", "dependencies": { - "undici-types": ">=7.24.0 <7.24.7" + "undici-types": "~6.21.0" } }, "node_modules/@typescript-eslint/eslint-plugin": { @@ -2701,9 +2701,9 @@ } }, "node_modules/undici-types": { - "version": "7.24.6", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz", - "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==", + "version": "6.21.0", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz", + "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==", "dev": true, "license": "MIT" }, diff --git a/package.json b/package.json index 1e6c1f2..9f62803 100644 --- a/package.json +++ b/package.json @@ -32,7 +32,7 @@ "devDependencies": { "@changesets/cli": "3.0.3", "@eslint/js": "10.0.1", - "@types/node": "25.9.8", + "@types/node": "22.20.5", "eslint": "10.11.0", "prettier": "3.9.8", "typescript": "6.0.3",