chore: bump @types/node from 22.19.17 to 22.20.1

[dependabot]

Bumps @types/node from 22.19.17 to 22.20.1.

Commits

• See full diff in compare view

[claude]

Claude finished @dependabot[bot]'s task in 1m 35s —— View job

---

Dependency review: @types/node 22.19.17 → 22.20.1

• Read the diff and identify the version change
• Check the Node floor (engines.node) and the @types/node pin convention
• Assess semver / breaking-change risk
• Build + test on the branch
• Post review

Verdict: LGTM — low risk, no changes requested.

What changed

A minor bump inside the 22.x line, lockfile-only (3 lines in package-lock.json). Not a major, so the dependabot.yml ignore rule (@types/node / version-update:semver-major) is still doing its job — no sign it broke. The transitive undici-types constraint is untouched.

package.json is correctly absent from the diff: the spec is "@types/node": "^22.0.0", which already satisfies 22.20.1, so only the resolution moves.

Floor alignment

The types still track Node 22, and every place that declares the floor is consistent and unmoved:

Location	Value
package.json engines.node	>=22
manifest.json compatibility.runtimes.node	>=22.0.0
README.md:18	Node.js ≥ 22
ci.yml:20 matrix	['22', '24']
update-catalog.yml:27	'22'

So this doesn't trip the "raising the Node floor means moving these together" rule in CLAUDE.md.

Risk assessment

@types/node ships type declarations only — nothing here can change runtime behaviour, and the only plausible failure mode for a DefinitelyTyped minor is a narrowed signature producing a fresh tsc error under strict: true. That didn't happen: CI is green (build + test + .mcpb smoke test) on both Node 22 and 24. skipLibCheck: true also caps the blast radius to declarations the code actually references.

The referenced Node API surface is small and long-stable — node:fs (readFileSync/writeFileSync), node:path (join/dirname), node:url (fileURLToPath), all in scripts/ plus test/version.test.ts. src/ imports no node: builtins at all, only globals like process.env in src/config.ts.

One pre-existing nuance (not introduced by this PR)

^22.0.0 combined with a floor of >=22 makes the floor-tracking guarantee approximate at the minor level: @types/node 22.20 describes APIs added across the whole Node 22 lifetime, so tsc will happily accept something introduced in, say, Node 22.12 even though engines permits 22.0.0. That gap widens slightly with every 22.x minor.

It's harmless today because nothing in src/ touches a node: builtin, and it's arguably the intended tradeoff (pinning ~22.0.0 would mean no security/bugfix type updates at all). Worth being aware of rather than acting on — flagging it only because dependabot.yml's comment frames the rule as exact.

Separately: tsconfig.json sets include: ["src"], so scripts/ and test/ are never type-checked by npm run build — the files that do use node: builtins are the ones tsc doesn't inspect. Also pre-existing and out of scope here.

Suggested follow-up

None required for this PR. If you want the floor guarantee to be real rather than approximate, the check worth adding someday is a tsc pass over scripts/ and test/ (a tsconfig.check.json with a wider include), so type regressions in the Node-API-using code surface in CI.
· branch