build(deps-dev): bump @types/node from 25.9.5 to 26.1.1

[dependabot]

Bumps @types/node from 25.9.5 to 26.1.1.

Commits

• See full diff in compare view

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 42af374564d01b990ae7d1285199ac05097fb3ef.

• Head SHA: 42af374564d01b990ae7d1285199ac05097fb3ef

• Workflow run: 29143938966

• Workflow attempt: 1

Coverage evidence

Coverage Evidence

• Head SHA: 42af374564d01b990ae7d1285199ac05097fb3ef
• Required test evidence: supported repository test suites must pass.
• Required docstring evidence: repository-owned docstring gates must pass when configured; otherwise docstring coverage is advisory.

JavaScript/TypeScript dependencies (npm install)

$ npm install 

added 131 packages, and audited 132 packages in 9s

54 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

• Result: PASS

JavaScript/TypeScript docstring coverage

• Result: PASS
• Reason: package.json exists, but no check:python-docstrings, docstring:coverage, or docs:coverage script is defined; docstring coverage is advisory.

JavaScript/TypeScript test coverage

• Result: FAIL
• Reason: package.json exists, but no coverage or test script is defined.

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: package.json"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: package.json"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: a58f9cf5b2c72b8057c5f2c9979977e9a8b96d34
• Workflow run: 29227520698
• Workflow attempt: 1
• Gate result: APPROVE (exit 0)

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

Current HEAD c4a1528 updates bun.lock for the existing @types/node 26.1.1 package.json bump. The previous Ubuntu/macOS failures both reported exactly: lockfile had changes, but lockfile is frozen. Verification: Bun 1.3.5 frozen install passed; eslint, TypeScript typecheck, and build passed; 3/3 Node tests passed; c8 statements/branches/functions/lines are all 100%; CodeGraph blast-radius review found no incompatible Node API surface. Only bun.lock changed beyond the Dependabot manifest bump.

Dismiss stale OpenCode requested-changes review from head 42af374. Current head is a58f9cf, and coverage-evidence/security checks have rerun on the current head.

[seonghobae]

Temporarily closing and reopening to retrigger the central required workflows on the same current head after ContextualWisdomLab/.github#512 landed; no source change intended.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[seonghobae]

Temporarily closing and reopening to retrigger the central required workflows on the same current head after ContextualWisdomLab/.github#510 landed; no source change intended.

[seonghobae]

Queue hygiene: closing briefly to cancel/retire stale required-workflow runs from before ContextualWisdomLab/.github#510. Reopening immediately on the same head.

[opencode-agent]

Pull request overview

OpenCode reviewed the current-head bounded evidence and found no blocking issues.

Findings

No blocking findings.

Summary

Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including bun.lock, package.json.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects bun.lock to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source checks are delegated to configured OpenCode web_search/Context7/DeepWiki sources when applicable; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: Playwright visual, DOM locator, ARIA snapshot, console, and responsive evidence were checked when a web UI surface was present; for non-web surfaces, API/CLI/log/docs/workflow interaction evidence was reviewed instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.

Adversarial validation

{"status":"passed","probes":[{"path":"package.json","line":63,"hypothesis":"The manifest and committed Bun lockfile could disagree, causing the CI frozen-lockfile install to fail.","attack_or_counterexample":"Clean sandbox with no node_modules, running npx --yes bun@1.3.5 install --frozen-lockfile.","evidence":"SANDBOXED_VERIFY_RESULT reported exit_code 0 for the frozen install and installed @types/node@26.1.1.","outcome":"falsified"},{"path":"bun.lock","line":73,"hypothesis":"The upgraded Node declarations or undici-types resolution could break repository validation despite a successful dependency install.","attack_or_counterexample":"Clean sandbox running npm install --no-package-lock, npm run lint, npm run typecheck, npm run build, and npm run test.","evidence":"SANDBOXED_VERIFY_RESULT reported exit_code 0; lint, typecheck, build, and all 3 tests passed.","outcome":"falsified"}],"residual_risk":"The caret range permits future 26.x declaration updates; repository CI typecheck and frozen-lockfile validation remain the control against unintended resolution changes."}

• Result: APPROVE
• Reason: The @types/node update and Bun lockfile are consistent and pass validation.
• Head SHA: a58f9cf5b2c72b8057c5f2c9979977e9a8b96d34
• Workflow run: 29227520698
• Workflow attempt: 1