chore: bump @types/node from 22.19.17 to 22.20.1

[dependabot]

Bumps @types/node from 22.19.17 to 22.20.1.

Commits

• See full diff in compare view

[claude]

Claude finished @dependabot[bot]'s task in 1m 39s —— View job

---

Dependency review: @types/node 22.19.17 → 22.20.1

• Read the diff and identify the version delta / semver level
• Check the Node floor (engines) and the dependabot ignore rule
• Check CI Node matrix and manifest.json runtime for drift
• Verify build + tests against the new types

Verdict: safe to merge. Patch-level bump of a dev-only type package, no code changes needed.

---

1. Semver: minor within the 22.x line — no major crossed

22.19.17 → 22.20.1 stays inside @types/node 22.x, which is exactly what the repo wants. The dependabot ignore rule is intact and behaved correctly:

# .github/dependabot.yml:24-25
- dependency-name: '@types/node'
  update-types: ['version-update:semver-major']

A major arriving here would signal that rule broke — it didn't. DefinitelyTyped ships no changelog per package; the delta is DT-internal type refinements to the Node 22 surface, with no runtime component.

2. Only package-lock.json changed — correct, not an omission

devDependencies["@types/node"] is ^22.0.0 (package.json:45), which already satisfies 22.20.1, so there's no manifest edit to make. undici-types stayed at ~6.21.0 (package-lock.json:840, outside the diff) — that matters because it supplies the fetch/Response/RequestInit typings that src/client/kosli-client.ts and its injectable fetchFn depend on. Unchanged means no risk there.

3. Node floor is unmoved and still consistent everywhere

The CLAUDE.md "raising the Node floor" checklist is not triggered by this PR — the floor stays at Node 22, and all six declarations still agree:

Location	Value
package.json:13 engines.node	>=22
manifest.json:74 runtimes.node	>=22.0.0
README.md:18	Node.js ≥ 22
ci.yml:20 matrix	['22', '24']
update-catalog.yml:27	22
@types/node	^22.0.0 → resolves 22.20.1

4. Actual Node API surface is tiny and ancient

Everything the repo touches predates Node 18, so a 22.x types minor can't plausibly break it:

• process.env — src/config.ts:4
• node:fs readFileSync/writeFileSync — test/version.test.ts:1, scripts/generate-catalog.ts:1, scripts/sync-version.mjs:11
• node:path, node:url fileURLToPath — scripts/generate-catalog.ts:2-3

strict: true is untouched, and no relative-import .js extensions are affected.

5. One structural note (pre-existing, not this PR)

DT publishes @types/node 22.x minors tracking successive Node 22.x releases, so 22.20 describes the API surface of roughly Node v22.20. Because the declared floor is >=22 / ^22.0.0 — permitting 22.0.0 — the types can green-light an API added later in the 22.x line, and tsc wouldn't catch it. That gap is inherent to the caret range rather than introduced here, and it's narrow in practice: CI installs the newest 22.x, and the API surface above is far older than any 22.x addition. Worth knowing, not worth acting on.

Verification

I could not run npm ci locally in this sandbox (network install needs approval that isn't available in this run), so the build/test confirmation comes from CI on this exact commit instead: CI passed — tsc build + Vitest on both Node 22 and 24, plus the .mcpb smoke test. That's the same coverage I'd have produced locally, on both ends of the supported range.

No follow-up checks or new tests needed.

--- · branch dependabot/npm_and_yarn/types/node-22.20.1