chore(deps)(deps-dev): bump @types/node from 25.9.1 to 26.1.1 - #88
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps)(deps-dev): bump @types/node from 25.9.1 to 26.1.1#88dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.1 to 26.1.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Threat surface review — no issues found
This PR only bumps the devDependency @types/node from 25.9.1 → 26.1.1 in:
apps/api/package.jsonapps/frontend/package.jsonapps/worker/package.jsonpackages/core/package.jsonpnpm-lock.yaml(plus transitiveundici-types7.24.6→8.3.0)
No application source, route handlers, auth/MCP code, or env files changed. @types/node / undici-types are TypeScript definition packages only and do not ship into production runtime bundles.
Surfaces checked
| Surface | Result |
|---|---|
| 1. MCP endpoint auth | Not in diff — no MCP/auth code changed |
| 2. Query execution sandboxing | Not in diff — no DuckDB/execute_query code changed |
| 3. Admin auth (Better Auth) | Not in diff — no auth/cookie/CSRF/env validation changed |
| 4. API input validation | Not in diff — no Hono/Zod handlers changed |
| 5. Environment secrets | Not in diff — no logging, responses, or committed secrets |
| 6. Dependency exposure | OK — type-only, actively maintained (@types/node@26.1.1, undici-types@8.3.0). pnpm audit --prod findings present in the tree are pre-existing (e.g. docs astro/esbuild) and not introduced by this bump |
Verdict: Changes look secure for the scoped threat surfaces; safe from a security standpoint as a compile-time types update.
Sent by Cursor Automation: archmax Security Review
Docker image readydocker pull ghcr.io/archmaxai/archmax:pr-88 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps @types/node from 25.9.1 to 26.1.1.
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Dev-only typings bump with no runtime or business-logic changes; main risk is new TypeScript compile errors from updated Node type definitions.
Overview
Bumps the
@types/nodedev dependency from^25(resolved 25.9.1) to^26(26.1.1) inapps/api,apps/frontend,apps/worker, andpackages/core, withpnpm-lock.yamlupdated so the monorepo resolves the new typings (includingundici-types8.3.0 via@types/node).This is a types-only change: no application runtime code is modified; TypeScript may surface new or stricter checks against Node 26-aligned APIs.
Reviewed by Cursor Bugbot for commit 1dca164. Bugbot is set up for automated code reviews on this repo. Configure here.