chore: bump @types/node from 22.19.17 to 22.20.3

[dependabot]

Bumps @types/node from 22.19.17 to 22.20.3.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[claude]

Claude finished @dependabot[bot]'s task in 1m 18s —— View job

---

Dependency review: @types/node 22.19.17 → 22.20.3

• Read PR diff
• Check Node floor (engines, manifest.json, ci.yml, README)
• Verify semver / major-ignore rule intact
• Assess actual Node API surface used
• Build + test — could not run locally (see note)

Verdict: safe to merge. Minor bump within the 22.x line, lockfile-only.

---

Major boundary & the ignore rule

Not a major — 22.19.17 → 22.20.3 stays inside ^22.0.0. The Dependabot guard is intact and doing its job:

# .github/dependabot.yml:24
- dependency-name: '@types/node'
  update-types: ['version-update:semver-major']

No 23.x/24.x leaked through, so nothing is broken there.

Node floor alignment

Every declaration of the floor still agrees, and none of them needed to move for this bump:

Location	Value
package.json:13 engines.node	>=22
package.json:45 @types/node	^22.0.0
manifest.json:67 compatibility.runtimes.node	>=22.0.0
README.md:18 Requirements	Node.js ≥ 22
.github/workflows/ci.yml:20 matrix	['22', '24']
.github/workflows/update-catalog.yml:27	'22'

(release.yml:26 runs Node 24 deliberately — build/publish only, per CLAUDE.md.)

Risk from type drift — low, and not new

Worth naming precisely since it's the whole reason the majors are pinned: DefinitelyTyped's minor track matches the Node minor it describes, so 22.20.x types describe APIs available on Node 22.20, while the declared floor is 22.0.0. tsc will therefore accept anything added across 22.1–22.20. That gap is inherent to the ^22.0.0 range and already existed at 22.19.17 — this PR widens it by one Node minor, it doesn't create it. DefinitelyTyped doesn't publish a floor-pinned branch, so the practical mitigation stays what it is today: the CI matrix's low end actually runs Node 22.

The realistic blast radius is tiny regardless. Everything shipped from src/ touches only long-stable surface:

• process.env / process.exit — src/config.ts:4,11,17, src/index.ts:13
• typeof globalThis.fetch — src/client/kosli-client.ts:23,67, src/tools/execute-action.ts:5,151
• node:fs, node:path, node:url in scripts/ only (not in rootDir: "src")

Nothing there has changed shape in the 22.x line. skipLibCheck: true (tsconfig.json:13) also absorbs any churn inside the .d.ts files themselves, so only the surface this code names can bite. strict: true is untouched — the diff is three lines of package-lock.json.

Note on verification

I couldn't run npm ci / npm run build / npm test in this session — npm wasn't in my allowed tools, and the checkout has no node_modules. The review above is from reading the diff and the source, not from a green build. CI's test (node 22) / test (node 24) jobs cover the compile check that matters here; if they pass, that is the real signal and I'd merge on it.

Suggested follow-up

None blocking. The one thing to keep in mind for later: when the Node floor is eventually raised, @types/node should move in the same PR as engines, manifest.json, README.md, and both workflow node-version values — bumping it on its own is what the ignore rule is preventing.
· branch dependabot/npm_and_yarn/types/node-22.20.3