build(deps): refresh Node types and cover Node 25 installs

[steipete]

What Problem This Solves

Dependency updates can pass the existing CI matrix while breaking development installs on Node 25, which remains inside the package's declared Node range.

User Impact

No router API, package output, runtime requirement, or package version changes. Development installs retain Node 25 compatibility, and CI now checks it on Ubuntu alongside the existing Node 22/24 platform matrix.

Why This Change Was Made

Update @types/node to 26.6.4 from #50, preserving the two-day release cooldown. Retain tsdown 0.22.14 and Vitest 4.1.11: tsdown 0.23.0 (#50) and Vitest 5.0.3 (#51) explicitly exclude Node 25 from their engine ranges, which conflicts with this repository's strict engine checks and supported development range. Document the CI compatibility contract and record the maintenance entry in Unreleased. Thanks @dependabot.

Evidence

• Linux with Node 25 and pnpm 11.27.1: pnpm install --frozen-lockfile && pnpm run check passed, including formatting, build, typecheck, type-aware lint, all 58 tests, and packed-package installation/import validation.
• Synthetic strict-engine installs on Node 25.9.0 rejected both tsdown 0.23.0 and Vitest 5.0.3 with ERR_PNPM_UNSUPPORTED_ENGINE, confirming the compatibility blocker.
• All workflow YAML parsed successfully; git diff --check passed.
• Independent Codex review: no actionable P0–P2 findings.

Supersedes the compatible Node types update in #50. Related: #51.

Exact-head CI passed for 44fae6824ab24c2998b92eeb6e1b76085769d88b: all seven Node/OS jobs and workflow lint in run 37598481727, plus CodeQL.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 7, 2026, 5:10 AM ET / 09:10 UTC.

ClawSweeper review

What this changes

Updates Node type declarations, adds an Ubuntu Node 25 CI job, and documents the supported development-install contract.

Merge readiness

✅ Ready for maintainer review

Keep open as a useful, focused maintenance PR. Current main lacks the new coverage and type update; the patch preserves the established compatibility contract and has no actionable findings.

Priority: P2
Reviewed head: 44fae6824ab24c2998b92eeb6e1b76085769d88b

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, compatible maintenance patch with passing supplied validation and no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: The member-authored PR is exempt from contributor proof. Its body nevertheless reports a Linux Node 25 frozen install and complete check exercising the changed development dependency graph; hosted Node 25 coverage also passes. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The member-authored PR is exempt from contributor proof. Its body nevertheless reports a Linux Node 25 frozen install and complete check exercising the changed development dependency graph; hosted Node 25 coverage also passes. No stored-data contract changes.
Evidence reviewed	7 items	Complete introduced diff: The pinned delta changes five files: one additional CI matrix entry, contributor documentation, an Unreleased changelog entry, and the matching Node-types manifest and lockfile update. No router source, runtime dependencies, exports, engine range, or package version changes. Supported-install contract preserved: The package declares Node ^22.18.0 || >=24.11.0, which includes Node 25. Workspace configuration retains engineStrict and the two-day release cooldown. The locked tsdown 0.22.14 and Vitest 4.1.11 engine ranges accept Node 25. Main and release necessity: Pinned main still uses @types/node 26.6.3 and its CI matrix contains only Node 22 and 24. The v0.1.2 CI workflow also lacks Node 25. This PR’s additional coverage remains distinct and unmerged.
Findings	None	None.
Security	None	None.

How this fits together

UIRouter’s development toolchain installs dependencies, builds the standalone router package, and validates its tests and published imports. CI checks that this workflow succeeds on supported Node versions.

flowchart TD
  A[Supported Node versions] --> C[Strict dependency installation]
  B[Locked development tools] --> C
  C --> D[Build and quality checks]
  D --> E[Router behavior tests]
  D --> F[Package import validation]
  E --> G[CI result]
  F --> G

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
CI runtime coverage	6 existing jobs retained; 1 Node 25 Ubuntu job added	The additional job covers a supported Node major absent from the existing matrix.

Technical review

Best possible solution:

Maintain supported development installs through a compatible locked toolchain and explicit Node 25 CI coverage.

Do we have a high-confidence way to reproduce the issue?

Not applicable to a current router bug: this PR prevents incompatible tooling upgrades, and source inspection verifies the missing Node 25 CI coverage.

Is this the best way to solve the issue?

Yes. Adding the missing matrix entry while retaining compatible tools is a narrow solution consistent with the recorded development-support decision.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f7320e4435a3.

Labels

Label changes:

• add P2: This bounded tooling improvement prevents supported development-install incompatibilities without changing router runtime behavior.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The member-authored PR is exempt from contributor proof. Its body nevertheless reports a Linux Node 25 frozen install and complete check exercising the changed development dependency graph; hosted Node 25 coverage also passes. No stored-data contract changes.

Label justifications:

• P2: This bounded tooling improvement prevents supported development-install incompatibilities without changing router runtime behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The member-authored PR is exempt from contributor proof. Its body nevertheless reports a Linux Node 25 frozen install and complete check exercising the changed development dependency graph; hosted Node 25 coverage also passes. No stored-data contract changes.

Evidence

What I checked:

• Complete introduced diff: The pinned delta changes five files: one additional CI matrix entry, contributor documentation, an Unreleased changelog entry, and the matching Node-types manifest and lockfile update. No router source, runtime dependencies, exports, engine range, or package version changes. (package.json:52, 44fae6824ab2)
• Supported-install contract preserved: The package declares Node ^22.18.0 || >=24.11.0, which includes Node 25. Workspace configuration retains engineStrict and the two-day release cooldown. The locked tsdown 0.22.14 and Vitest 4.1.11 engine ranges accept Node 25. (package.json:62, 44fae6824ab2)
• Main and release necessity: Pinned main still uses @types/node 26.6.3 and its CI matrix contains only Node 22 and 24. The v0.1.2 CI workflow also lacks Node 25. This PR’s additional coverage remains distinct and unmerged. (.github/workflows/ci.yml:38, f7320e4435a3)
• Recorded compatibility decision: The member-authored PR body expressly retains compatible build and test tools. The author’s comment at build(deps-dev): bump vitest from 4.1.11 to 5.0.3 #51 (comment) records a Node 25 strict-engine installation failure with Vitest 5.0.3 and confirms retaining Vitest 4.1.11 while this PR adds coverage. That related upgrade closed unmerged.
• Validation evidence: The captured body reports an after-change Linux Node 25 installation and full package check, including 58 tests and packed-package import validation. Supplied hosted checks pass across all seven matrix jobs. Reviewer-side YAML parsing and git diff --check also passed; installation, builds, and tests were not rerun because this review is read-only. (.github/workflows/ci.yml:45, 44fae6824ab2)
• Dependency supply-chain metadata: The npm registry identifies DefinitelyTyped/DefinitelyTyped, directory types/node, as the updated package’s repository. Version 26.6.4 has no lifecycle scripts, retains undici-types ~8.9.0, and its registry integrity matches the introduced lockfile value.

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.