chore(deps-dev): bump @types/node from 25.9.3 to 26.0.1

[dependabot]

Bumps @types/node from 25.9.3 to 26.0.1.

Commits

• See full diff in compare view

[mgoodric]

Automated PR Review

Risk: HIGH | Bump: major (@types/node 25→26) | Verdict: NEEDS_REVIEW

Changelog Analysis

Major version bump of @types/node from 25 to 26, tracking Node.js 26 type definitions. Node 26 is an odd (non-LTS) release and its type definitions may include changed or narrowed types for built-in APIs (e.g. process.env, Buffer, fs, crypto). Breaking TypeScript compilation is possible.

Security

No CVEs expected from a type definition package. Security scans passed.

Upstream Peer-Dep Check

Other packages in package.json may declare peer ranges on @types/node versions. Verify that no installed package requires @types/node@^25 explicitly.

Build / Type Check / Tests

Not run — policy requires human review for all major version bumps before automated validation.

Downstream Workflow Simulation

Not run — per policy.

Recommendation

Requires human review. Major type definition bump. Verify TypeScript compiles cleanly (tsc --noEmit) and that no runtime behavior has changed. Consider pinning to an LTS-aligned @types/node version if Node 26 LTS support is not yet planned.

---

Generated by Claude Code

[mgoodric]

Needs human review — risk: HIGH (major version bump)

This PR contains a major version bump. Major upgrades may include breaking API changes. Auto-merge is disabled for major version bumps per policy. Please review the changelog and verify compatibility before merging.

---

Generated by Claude Code

[mgoodric]

Automated PR Review

Risk: HIGH | Bump: @types/node 25.9.3 → 26.0.1 (major) | Verdict: NEEDS_REVIEW

Changelog Analysis

@types/node v26 tracks Node.js 26.x LTS. Breaking changes include removed/renamed type definitions for APIs deprecated in Node 24 (e.g. util.isArray, util.isPrimitive and related util.is* predicates are fully removed; fs.Stats constructor types narrowed). The Crypto global type surface also changed. Since travel-tracker is a Next.js app that doesn't call Node built-ins directly at runtime (server actions use postgres.js and Next.js APIs), impact is likely limited to type errors in scripts or test helpers that reference those removed types.

Security

No CVE associated with this type-only package bump.

Upstream Peer-Dep Check

@types/node v26 requires TypeScript ≥5.0 (satisfied). No peer conflicts visible in the travel-tracker dependency tree.

Build / Type / Tests

CI run on 2026-06-29T18:14 — all 6 checks green: ✅ build, ✅ test, ✅ lint, ✅ CodeQL, ✅ Trivy, ✅ GitGuardian. Build passes, so no removed types are referenced in production code paths.

Downstream Workflow Simulation

npm run build and tsc --noEmit pass per CI. Scripts in /scripts/ are excluded from the TS build; if they reference removed util.is* types those would surface only at runtime, not in CI.

Recommendation

CI is fully green and the type changes don't appear to affect this codebase. However, this is a major version bump (@types/node 25 → 26 tracks Node 25 → Node 26 LTS). Standard policy: human review before merge on major dep bumps. Recommend reviewing the Node.js 26 release notes and the @types/node v26 changelog, then merging if no surprises.

Automated review posted by PR-review-bot — 2026-06-30

---

Generated by Claude Code

[dependabot]

Superseded by #68.