build(deps): land the reviewed @types/node 26.6.2 refresh

Dependabot npm-minor-patch #2189 raises @types/node 26.6.1 -> 26.6.2 in frontend-modern and tests/integration, but Canonical Governance blocks the manifest/lock change for a missing deployment-installability contract entry and frontend dependency security proof. The portal frontend part of the same group is a separate ws override refresh that needs a portal bundle decision and is owned separately, so it is not carried here.

Carry the frontend-modern and tests/integration @types/node 26.6.2 bump with a Current State contract entry and a dependencySecurity floor raise. @types/node is a dev-only declaration package and does not enter the shipped bundle; @playwright/test stays pinned at 1.56.1, so browser-test parity is unchanged. The frontend-modern offline dependency snapshot is bound to 26.6.1, so npm ci --offline cannot resolve the 26.6.2 tarball in this assignment; a host dependency acquisition is required before the suite can run against the new lockfile.

Change-source: pulse-maintainer

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -2430,6 +2430,28 @@ parity is unchanged.
 `frontend-modern/src/security/__tests__/dependencySecurity.test.ts` pins the
 manifest ranges and locked floors so a later downgrade is rejected.
 
+### Reviewed @types/node 26.6.2 refresh
+
+The 2026-09-23 `npm-minor-patch` group (Dependabot #2189) advances the
+`@types/node` type-surface dependency from 26.6.1 to 26.6.2 in both
+`frontend-modern` and `tests/integration`, with no other direct version change
+in those two manifests. The portal `internal/cloudcp/portal/frontend` part of the
+same group is a separate `ws` override refresh that requires a portal bundle
+decision and is owned separately, so it is not carried here. `@types/node` is a
+dev-only declaration package: it does not enter the shipped frontend bundle,
+the installer, the artifact, signing, promotion or rollback boundary. The
+`dependencySecurity.test.ts` reviewed floor for `@types/node` moves to 26.6.2 so
+a later downgrade below this review is rejected, and `@playwright/test` stays
+pinned at 1.56.1, so browser-test parity is unchanged.
+
+Verification status: the `frontend-modern` offline dependency snapshot is bound
+to the previously locked `@types/node` 26.6.1, so `npm ci --offline` against the
+updated lockfile cannot resolve the 26.6.2 tarball in this assignment. The
+manifest/lock/contract/proof change is prepared and its static version
+assertions hold, but a host dependency acquisition on a later launch is required
+before the frontend suite can be executed against the new lockfile. No passing
+frontend suite or release acceptance is claimed here.
+
 ### Manual update freshness
 
 Manual update checks carry explicit freshness to the update manager. They bypass

frontend-modern/package-lock.json

@@ -22,7 +22,7 @@
         "@solidjs/testing-library": "^0.8.5",
         "@tailwindcss/typography": "^0.5.19",
         "@testing-library/jest-dom": "^6.5.0",
-        "@types/node": "^26.6.1",
+        "@types/node": "^26.6.2",
         "@types/qrcode": "^1.5.6",
         "@typescript-eslint/eslint-plugin": "^8.70.0",
         "@typescript-eslint/parser": "^8.70.0",
@@ -1969,9 +1969,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "26.6.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.1.tgz",
-      "integrity": "sha512-VqGJBMCtdhqkBUCcBLvywI0NJ+KLuVzgNnlBUNFOQjqVxzo2lxLUNg1DSey8+u2u6ktswSAxg+s68QLzWHNOuA==",
+      "version": "26.6.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
+      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

frontend-modern/package.json

@@ -73,7 +73,7 @@
     "@solidjs/testing-library": "^0.8.5",
     "@tailwindcss/typography": "^0.5.19",
     "@testing-library/jest-dom": "^6.5.0",
-    "@types/node": "^26.6.1",
+    "@types/node": "^26.6.2",
     "@types/qrcode": "^1.5.6",
     "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",

frontend-modern/src/security/__tests__/dependencySecurity.test.ts

@@ -173,13 +173,15 @@ describe('frontend dependency security floors', () => {
   });
 
   it('keeps the reviewed npm-minor-patch floors', () => {
-    // Dependabot npm-minor-patch group, reviewed 2026-09-21. Each floor is the
-    // lowest version this review accepted, so a later downgrade is rejected.
+    // Dependabot npm-minor-patch group, reviewed 2026-09-21 and 2026-09-23.
+    // Each floor is the lowest version this review accepted, so a later
+    // downgrade is rejected. The 2026-09-23 refresh raises @types/node to
+    // 26.6.2 in frontend-modern and tests/integration.
     const floors: Array<[string, [number, number, number]]> = [
       ['dompurify', [3, 4, 15]],
       ['highlight.js', [11, 12, 0]],
       ['solid-js', [1, 9, 15]],
-      ['@types/node', [26, 6, 1]],
+      ['@types/node', [26, 6, 2]],
       ['typescript-eslint', [8, 70, 0]],
       ['@typescript-eslint/eslint-plugin', [8, 70, 0]],
       ['@typescript-eslint/parser', [8, 70, 0]],

tests/integration/package-lock.json

@@ -11,7 +11,7 @@
       "devDependencies": {
         "@axe-core/playwright": "^4.13.0",
         "@playwright/test": "1.56.1",
-        "@types/node": "^26.6.1",
+        "@types/node": "^26.6.2",
         "@types/ws": "^8.18.1",
         "typescript": "^7.0.2",
         "ws": "^8.21.3"
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "26.6.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.1.tgz",
-      "integrity": "sha512-VqGJBMCtdhqkBUCcBLvywI0NJ+KLuVzgNnlBUNFOQjqVxzo2lxLUNg1DSey8+u2u6ktswSAxg+s68QLzWHNOuA==",
+      "version": "26.6.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz",
+      "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

tests/integration/package.json

@@ -31,7 +31,7 @@
   "devDependencies": {
     "@axe-core/playwright": "^4.13.0",
     "@playwright/test": "1.56.1",
-    "@types/node": "^26.6.1",
+    "@types/node": "^26.6.2",
     "@types/ws": "^8.18.1",
     "typescript": "^7.0.2",
     "ws": "^8.21.3"