From 8654c837ee37ba68fe8442bbee734cb1811d8049 Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Wed, 23 Sep 2026 09:26:24 +0100 Subject: [PATCH] build(deps): land the reviewed @types/node 26.6.2 refresh Dependabot npm-minor-patch #2189 raises @types/node 26.6.1 -> 26.6.2 in frontend-modern and tests/integration, but Canonical Governance blocks the manifest/lock change for a missing deployment-installability contract entry and frontend dependency security proof. The portal frontend part of the same group is a separate ws override refresh that needs a portal bundle decision and is owned separately, so it is not carried here. Carry the frontend-modern and tests/integration @types/node 26.6.2 bump with a Current State contract entry and a dependencySecurity floor raise. @types/node is a dev-only declaration package and does not enter the shipped bundle; @playwright/test stays pinned at 1.56.1, so browser-test parity is unchanged. The frontend-modern offline dependency snapshot is bound to 26.6.1, so npm ci --offline cannot resolve the 26.6.2 tarball in this assignment; a host dependency acquisition is required before the suite can run against the new lockfile. Change-source: pulse-maintainer --- .../subsystems/deployment-installability.md | 22 +++++++++++++++++++ frontend-modern/package-lock.json | 8 +++---- frontend-modern/package.json | 2 +- .../__tests__/dependencySecurity.test.ts | 8 ++++--- tests/integration/package-lock.json | 8 +++---- tests/integration/package.json | 2 +- 6 files changed, 37 insertions(+), 13 deletions(-) diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index ef91b37424..013b563c0f 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -2430,6 +2430,28 @@ parity is unchanged. `frontend-modern/src/security/__tests__/dependencySecurity.test.ts` pins the manifest ranges and locked floors so a later downgrade is rejected. +### Reviewed @types/node 26.6.2 refresh + +The 2026-09-23 `npm-minor-patch` group (Dependabot #2189) advances the +`@types/node` type-surface dependency from 26.6.1 to 26.6.2 in both +`frontend-modern` and `tests/integration`, with no other direct version change +in those two manifests. The portal `internal/cloudcp/portal/frontend` part of the +same group is a separate `ws` override refresh that requires a portal bundle +decision and is owned separately, so it is not carried here. `@types/node` is a +dev-only declaration package: it does not enter the shipped frontend bundle, +the installer, the artifact, signing, promotion or rollback boundary. The +`dependencySecurity.test.ts` reviewed floor for `@types/node` moves to 26.6.2 so +a later downgrade below this review is rejected, and `@playwright/test` stays +pinned at 1.56.1, so browser-test parity is unchanged. + +Verification status: the `frontend-modern` offline dependency snapshot is bound +to the previously locked `@types/node` 26.6.1, so `npm ci --offline` against the +updated lockfile cannot resolve the 26.6.2 tarball in this assignment. The +manifest/lock/contract/proof change is prepared and its static version +assertions hold, but a host dependency acquisition on a later launch is required +before the frontend suite can be executed against the new lockfile. No passing +frontend suite or release acceptance is claimed here. + ### Manual update freshness Manual update checks carry explicit freshness to the update manager. They bypass diff --git a/frontend-modern/package-lock.json b/frontend-modern/package-lock.json index 36215a2dbd..c80c78c109 100644 --- a/frontend-modern/package-lock.json +++ b/frontend-modern/package-lock.json @@ -22,7 +22,7 @@ "@solidjs/testing-library": "^0.8.5", "@tailwindcss/typography": "^0.5.19", "@testing-library/jest-dom": "^6.5.0", - "@types/node": "^26.6.1", + "@types/node": "^26.6.2", "@types/qrcode": "^1.5.6", "@typescript-eslint/eslint-plugin": "^8.70.0", "@typescript-eslint/parser": "^8.70.0", @@ -1969,9 +1969,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "26.6.1", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.1.tgz", - "integrity": "sha512-VqGJBMCtdhqkBUCcBLvywI0NJ+KLuVzgNnlBUNFOQjqVxzo2lxLUNg1DSey8+u2u6ktswSAxg+s68QLzWHNOuA==", + "version": "26.6.2", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz", + "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==", "dev": true, "license": "MIT", "dependencies": { diff --git a/frontend-modern/package.json b/frontend-modern/package.json index 1187237813..2c1df0c446 100644 --- a/frontend-modern/package.json +++ b/frontend-modern/package.json @@ -73,7 +73,7 @@ "@solidjs/testing-library": "^0.8.5", "@tailwindcss/typography": "^0.5.19", "@testing-library/jest-dom": "^6.5.0", - "@types/node": "^26.6.1", + "@types/node": "^26.6.2", "@types/qrcode": "^1.5.6", "@typescript-eslint/eslint-plugin": "^8.70.0", "@typescript-eslint/parser": "^8.70.0", diff --git a/frontend-modern/src/security/__tests__/dependencySecurity.test.ts b/frontend-modern/src/security/__tests__/dependencySecurity.test.ts index 4f64396eb4..d69d08533e 100644 --- a/frontend-modern/src/security/__tests__/dependencySecurity.test.ts +++ b/frontend-modern/src/security/__tests__/dependencySecurity.test.ts @@ -173,13 +173,15 @@ describe('frontend dependency security floors', () => { }); it('keeps the reviewed npm-minor-patch floors', () => { - // Dependabot npm-minor-patch group, reviewed 2026-09-21. Each floor is the - // lowest version this review accepted, so a later downgrade is rejected. + // Dependabot npm-minor-patch group, reviewed 2026-09-21 and 2026-09-23. + // Each floor is the lowest version this review accepted, so a later + // downgrade is rejected. The 2026-09-23 refresh raises @types/node to + // 26.6.2 in frontend-modern and tests/integration. const floors: Array<[string, [number, number, number]]> = [ ['dompurify', [3, 4, 15]], ['highlight.js', [11, 12, 0]], ['solid-js', [1, 9, 15]], - ['@types/node', [26, 6, 1]], + ['@types/node', [26, 6, 2]], ['typescript-eslint', [8, 70, 0]], ['@typescript-eslint/eslint-plugin', [8, 70, 0]], ['@typescript-eslint/parser', [8, 70, 0]], diff --git a/tests/integration/package-lock.json b/tests/integration/package-lock.json index b25af0ee6a..beb6f87eb1 100644 --- a/tests/integration/package-lock.json +++ b/tests/integration/package-lock.json @@ -11,7 +11,7 @@ "devDependencies": { "@axe-core/playwright": "^4.13.0", "@playwright/test": "1.56.1", - "@types/node": "^26.6.1", + "@types/node": "^26.6.2", "@types/ws": "^8.18.1", "typescript": "^7.0.2", "ws": "^8.21.3" @@ -47,9 +47,9 @@ } }, "node_modules/@types/node": { - "version": "26.6.1", - "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.1.tgz", - "integrity": "sha512-VqGJBMCtdhqkBUCcBLvywI0NJ+KLuVzgNnlBUNFOQjqVxzo2lxLUNg1DSey8+u2u6ktswSAxg+s68QLzWHNOuA==", + "version": "26.6.2", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.2.tgz", + "integrity": "sha512-X1P21scMv4zGKLYqjdGjaKa7COa0RKVYYZZN/NfvLQ1JegxFhdhpZG/Lyn8AXx6CDUavKAd11v6BvfpkDByK8g==", "dev": true, "license": "MIT", "dependencies": { diff --git a/tests/integration/package.json b/tests/integration/package.json index 5798d54a9b..306e8a45ee 100644 --- a/tests/integration/package.json +++ b/tests/integration/package.json @@ -31,7 +31,7 @@ "devDependencies": { "@axe-core/playwright": "^4.13.0", "@playwright/test": "1.56.1", - "@types/node": "^26.6.1", + "@types/node": "^26.6.2", "@types/ws": "^8.18.1", "typescript": "^7.0.2", "ws": "^8.21.3"