chore(deps-dev): bump the typescript-ecosystem group across 1 directory with 2 updates

[dependabot]

Bumps the typescript-ecosystem group with 2 updates in the / directory: @types/node and typescript.

Updates @types/node from 22.20.0 to 26.0.1

Commits

• See full diff in compare view

Updates typescript from 5.9.3 to 6.0.3

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• 050880c Bump version to 6.0.3 and LKG
• eeae9dd 🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...
• ad1c695 🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)
• 0725fb4 🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...
• 607a22a Bump version to 6.0.2 and LKG
• 9e72ab7 🤖 Pick PR #63239 (Fix missing lib files in reused pro...) into release-6.0 (#...
• 35ff23d 🤖 Pick PR #63163 (Port anyFunctionType subtype fix an...) into release-6.0 (#...
• e175b69 Bump version to 6.0.1-rc and LKG
• af4caac Update LKG
• 8efd7e8 Merge remote-tracking branch 'origin/main' into release-6.0
• Additional commits viewable in compare view

[tps-flint]

CI failure — TypeScript 6.x breaks the build

Group bump pulled typescript and @types/node to next-major. Build fails with 9 errors across packages/shell/src/:

• Cannot find name 'process' (multiple sites) — @types/node not resolved in the workspace
• Cannot find name 'node:fs' / 'node:path' / 'node:url' — same root cause
• Property 'url' does not exist on type 'ImportMeta' — likely TS 6.x ImportMeta shape change requires explicit lib: ["ES2022"] or module: "NodeNext" adjustment

Full log: https://github.com/tpsdev-ai/bob/actions/runs/26209910635/job/77118095945

Recommendation: don't merge. Either:

• Pin TS to ^5.7.0 and let @types/node advance alone, or
• Investigate the TS 6.x migration as a separate effort (config changes + verify import.meta.url still resolves under NodeNext)

The actions/checkout (#11) and codeql-action (#10) PRs are safe — both CI-green, no code changes needed.

— flint

[tps-kern]

Architecture Review — REQUEST_CHANGES ❌

Dev dependency bumps: @types/node ^22→^25, typescript ^5.7→^6.0 in root package.json.

CI: Build FAILURE, Dependency Audit FAILURE, Unit Tests SKIPPED.

TypeScript 5→6 is a MAJOR version bump. TS 6 introduces breaking changes including:

• Stricter type checking in several areas
• Changes to module resolution behavior
• New compiler defaults

The build failure confirms the codebase is not compatible with TS 6 as-is. The Dependency Audit failure may be related to @types/node 25 pulling in types that conflict.

Action required:

1. Check CI build logs for specific TS 6 compilation errors.
2. Fix all type errors before merging — this is not a "bump and hope" situation.
3. Consider whether bob should stay on TS 5.x for now (close this PR and pin to "typescript": "~5.9.3").
4. If upgrading to TS 6 is desired, create a dedicated migration PR with the fixes, not a raw dependabot bump.

Do not merge with red CI. A TS major version upgrade needs explicit validation, not an automated bump.

[tps-sherlock]

Security/Auth Review — APPROVE ✅

Change: Dev dependency bumps in package.json:

-    "@types/node": "^22.0.0",
-    "typescript": "^5.7.0"
+    "@types/node": "^25.9.1",
+    "typescript": "^6.0.3"

Security assessment:

1. Dev-only dependencies — both @types/node and typescript are devDependencies. Neither ships in production artifacts. No runtime attack surface change. ✅
2. Trusted sources — @types/node from DefinitelyTyped (Microsoft-maintained), typescript from Microsoft. Both are well-established, high-reputation packages. ✅
3. No auth/permission changes — no new secrets, tokens, credential handling, or permission escalations. ✅
4. No new runtime dependencies — the dependency count and runtime surface are unchanged. ✅
5. No supply-chain risk — these are the canonical packages for their respective purposes, not obscure alternatives. ✅

Note: Kern has flagged CI failures (build, audit) and requested changes on architecture grounds. Those are valid build-health concerns but fall outside the security/auth lane. From a pure security/auth perspective, dev-only type/compiler bumps from trusted sources carry no risk.

Verdict: No security or auth concerns. APPROVE from security/auth lane. (Architecture lane has requested changes for CI failures — those should be resolved before merge.)