chore(deps): bump @types/node from 25.3.5 to 26.4.1

[dependabot]

Bumps @types/node from 25.3.5 to 26.4.1.

Commits

• See full diff in compare view

[mozilla-blender]

Reviewing this major version bump. Workflow run

[mozilla-blender]

BLEnder picked up this PR. Workflow run

[mozilla-blender]

NEEDS_REVIEW: this major version bump needs code-owner review

Confidence: high
Reason: CI is failing on this PR in exactly the jobs that would surface an @types/node breakage: npm-lint (whose lint script ends in tsc -p tsconfig.json --noEmit), npm-build (which runs next build, including type-checking), and Build Docker image (which runs the same build). The failures are almost certainly caused by the bump rather than incidental, because type-only packages break precisely at the type-check step. Compounding this, the repo pins engines.node to 20.20.x (Dockerfile node:20.20-alpine, volta 20.20.2, CI setup-node 20.20.x, esbuild target node20.20) while @types/node v26 declares the Node 26 API surface — the types would be four majors ahead of the runtime, so type-checking would start accepting APIs that do not exist in production Node 20 and would apply v26's stricter Buffer/Uint8Array and ProcessEnv typings to existing code. tsconfig sets strict:true and checkJs:true with no types restriction, so @types/node is loaded globally and also applied to plain JS files (src/db/migrations/.js, src/scripts/build/.js, next.config.js), widening the blast radius. This is not auto-mergeable without code changes.

Breaking changes: @types/node major versions track the Node.js release line: v26 replaces the Node 25 API surface with the Node 26 surface, removing/altering declarations for APIs deprecated or changed in Node 26.; Type declarations become ahead of the pinned runtime (Node 20.20.x), so TypeScript will permit Node 26-only APIs that do not exist at runtime — a silent correctness hazard that the type checker can no longer catch.; Recurring @types/node major-bump breakage class: Buffer is typed as Uint8Array, so passing Buffer to WebCrypto, fetch, and web-stream signatures (and vice versa) becomes an error under strict mode.; Recurring @types/node major-bump breakage class: NodeJS.ProcessEnv index-signature/NODE_ENV narrowing, making process.env.X (string | undefined) assignments and comparisons fail under strict:true.; Recurring @types/node major-bump breakage class: NodeJS.Timeout / setTimeout-setInterval return types and globalThis augmentation changes affecting DOM-vs-Node timer overload resolution in a project whose lib includes both dom and esnext.; The PR body contains no real changelog (DefinitelyTyped ships no release notes and the 'Release notes' section shows '0.1.450 None'), so the exact removed/renamed declarations cannot be enumerated from the PR.
Affected code: package.json — lint script (stylelint && prettier && eslint && next typegen && tsc -p tsconfig.json --noEmit && npm run validate-nimbus); the npm-lint CI job fails here.; package.json — build script (build-glean && build-nimbus && next build && build-cronjobs); the npm-build and Build Docker image CI jobs fail here.; tsconfig.json — strict:true, checkJs:true, allowJs:true, no types array, lib ['dom','dom.iterable','esnext']; @types/node applies globally to TS and to included JS files.; tsconfig.cronjobs.json — module/moduleResolution NodeNext for src/scripts/cronjobs/** and src/emails/**, a second resolution mode where node builtin typings resolve differently.; next.config.js:109 — noindexEnvs.includes(process.env.NODE_ENV) on a string[]; breaks if ProcessEnv/NODE_ENV typing narrows (compared values 'dev', 'heroku', 'stage' are not valid NODE_ENV literals).; next.config.js:213,224 — process.env.SENTRY_AUTH_TOKEN and process.env.UPLOAD_SENTRY_SOURCEMAPS.; src/db/knexfile.ts:39 — connectionObj.host = /** @type {string} */ process.env.PG_HOST; the JSDoc cast is inert in a .ts file, so string | undefined is assigned and this is fragile under any ProcessEnv typing change.; src/config.ts — central process.env aggregation module (imported by src/db/knexfile.ts:10); primary exposure to ProcessEnv typing changes.; src/scripts/build/gleanTypes.js:11-12 — import fs from 'fs/promises' and import { resolve } from 'path'; fs.writeFile/readdir/readFile at lines 18, 24, 83, type-checked because checkJs is on.; src/scripts/build/nimbusTypes.js:5 — import { mkdir, readFile, writeFile } from 'node:fs/promises' used at lines 59, 73, 74.; esbuild.cronjobs.js:27 — target: 'node20.20', confirming the runtime/type mismatch.; Buffer-passing dependency surface not individually verified but at risk: jose, jsonwebtoken, jwk-to-pem, sharp, @aws-sdk/client-s3, @aws-sdk/lib-storage, adm-zip, nodemailer, mjml.
Test coverage: Type-only dependency, so the meaningful 'test' is the type checker, and it is red. tsc -p tsconfig.json --noEmit runs inside npm-lint and next build type-checks in npm-build — both jobs FAIL on this PR, on both reported runs. The runtime suites that pass (unit-tests, functional-tests, test-integrations, l10n-lint, detect-unresolved-conflicts) provide no signal here: @types/node emits no JavaScript, so a green unit-test run cannot exonerate a types bump. Coverage of the actual Node-builtin callsites could not be fully inventoried — the exploration pass lacked working grep/glob, so only next.config.js, src/db/knexfile.ts, src/scripts/build/gleanTypes.js and src/scripts/build/nimbusTypes.js were confirmed, and no audit of NodeJS.* type positions, declare-global blocks, or Buffer-vs-Uint8Array boundaries was completed. That inventory gap alone would warrant a conservative verdict; combined with three failing type-checking CI jobs and a four-major runtime/types skew (Node 20 runtime vs Node 26 types), this needs human review and code changes before merge.

[mozilla-blender]

BLEnder could not fix this PR automatically. Workflow run

[dependabot]

Superseded by #6837.