chore: bump @types/node from 22.19.17 to 22.20.2

[dependabot]

Bumps @types/node from 22.19.17 to 22.20.2.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @dependabot[bot]'s task in 1m 9s —— View job

---

Dependency review: @types/node 22.19.17 → 22.20.2

• Read PR diff and dependabot config
• Check Node floor consistency (engines, manifest.json, ci.yml, README)
• Verify semver / major-ignore rule intact
• Check build + tests (via CI — npm not in my allowed tools)
• Post review

Verdict: safe to merge. Lockfile-only, minor bump within the 22.x line.

What changed

Only package-lock.json (+3/-3): the @types/node version, tarball URL, and integrity hash. package.json still declares "@types/node": "^22.0.0", so the declared range is untouched — this is a resolution refresh inside the existing range.

Semver and the major-ignore rule

22.19.17 → 22.20.2 is a minor bump, no major crossing. The ignore rule in .github/dependabot.yml:24-25 only blocks version-update:semver-major, so it's working as designed here — nothing broke.

Node floor alignment

The floor is Node 22, and all six places CLAUDE.md says must move together are consistent:

Declaration	Value
package.json engines.node	>=22
package.json @types/node	^22.0.0
manifest.json:74 compatibility.runtimes.node	>=22.0.0
README.md:18 Requirements	Node.js ≥ 22
ci.yml:20 matrix	['22', '24']
update-catalog.yml:27	'22'

release.yml:26 uses Node 24, which is deliberate per CLAUDE.md (build + publish only). Types still track major 22 as required.

Risk to this codebase

Negligible. The Node-specific API surface in src/ is tiny and long-stable:

• process.env — src/config.ts:4,9,14
• process.exit — src/index.ts:109
• typeof globalThis.fetch — src/client/kosli-client.ts:23,67, src/tools/execute-action.ts:4,65

The only one worth a second look is globalThis.fetch, whose type comes from the undici-types dependency that @types/node pulls in — minor bumps there have historically reshuffled RequestInit/Response typings. CI is green on both Node 22 and 24 (run), so tsc --strict accepted the new definitions and the injected-fetchFn tests still typecheck. No action needed.

One pre-existing gap, not introduced here

engines.node: ">=22" admits Node 22.0.0, but @types/node@22.20.2 describes APIs added across the whole 22.x line — so tsc would accept something like a Node 22.13-only API without complaint. The CI matrix doesn't catch this either: node-version: '22' resolves to the latest 22.x, not the floor.

That gap widens slightly with every @types/node minor, but it's a property of the ^22.0.0 range rather than anything this PR does, and the current API surface above is nowhere near the edge of it. Worth knowing rather than acting on; if it ever becomes a real concern, pinning the CI matrix low end to an explicit 22.0.0 would exercise the actual floor.
· dependabot/npm_and_yarn/types/node-22.20.2