chore(deps-dev): bump @types/node from 22.12.0 to 26.1.1

[dependabot]

Bumps @types/node from 22.12.0 to 26.1.1.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[todie]

Jury verdict: REQUEST_CHANGES — not stale, so leaving this open rather than closing. Needs a pin correction.

First, a correction to the queue metadata: mergeable reads MERGEABLE/CLEAN, not UNKNOWN, and both checks pass. The problem isn't mergeability.

P2 — this breaks a deliberate lockstep pin. .prototools pins node = "22.12.0" and the outgoing @types/node was 22.12.0 — an exact match. Bumping types four majors to 26.1.1 means the repo builds and runs on Node 22.12.0 while type-checking against Node 26 declarations. Any Node 26-only API would type-check clean and fail at runtime on the pinned toolchain. packages/create engines.node: ">=20" floors lower still.

P2 — green CI is not evidence of safety here. moon ci does run typecheck (tsc --noEmit via the node tag), but packages/create/tsconfig.json sets skipLibCheck: true and the source only touches node:fs, node:path, process. The exercised type surface is far too narrow to detect the mismatch, so CI passing tells you nothing about this bump.

P3 — no drift gate covers this coupling. The repo already has an explicit 3-way pin-drift gate for the pi-coding-agent devDependency (6864efe, OPS-749). The @types/node ↔ .prototools node coupling has no equivalent assertion and drifts silently — this PR is the proof.

P3 — not confined to packages/create. The lockfile shows a transitive consumer also resolving @types/node@26.1.1, with undici-types jumping 6.20.0 → 8.3.0. Masked today by skipLibCheck.

Fix: pin @types/node to the 22.x line matching .prototools, or bump the node toolchain pin in the same PR so runtime and types move together.