chore(deps): bump @types/node from 26.4.0 to 26.5.0

[dependabot]

Bumps @types/node from 26.4.0 to 26.5.0.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

No changeset found

This PR does not add a changeset, so it will not appear in the changelog or trigger a release.

If the change is user-facing, add one:

pnpm changeset

Pick a bump (patch / minor / major) and write the changelog entry in our usual voice ("Added X... Thanks to @you. Closes #123."), then commit the generated .changeset/*.md file.

If this PR is docs-only or a chore that needs no release note, you can ignore this — or run pnpm changeset --empty to record that intentionally.

[github-actions]

nc-review: comments — 2 nits

Routine Dependabot bump of @types/node from 26.4.0 to 26.5.0 with a transitive undici-types refresh, touching only pnpm-lock.yaml. The change itself is safe (dev-only type definitions) and correct: the lockfile entries match, the integrity hashes are present, and the snapshot block is consistent with the package block. The PR does not introduce any new misconfiguration, but it surfaces a long-standing inconsistency the project should clean up: CONTRIBUTING.md's 'Stack Divergence' section declares json-up uses npm, yet the repo ships pnpm-lock.yaml, a pnpm-workspace.yaml, and a packageManager: pnpm@11.0.9 field, and is wired up so that Dependabot (via the branch-name prefix npm_and_yarn) is regularly producing pnpm-lock-only PRs against it. That inconsistency is pre-existing, so it does not block this PR, but it is worth filing separately and is why this PR does not get a clean verdict.

⚪ nit · contributing · CONTRIBUTING.md:103

CONTRIBUTING.md claims json-up uses npm in the 'Stack Divergence' section:

The Nano Collective's stack suggestions recommend pnpm as the default package manager for TypeScript projects. json-up uses npm ...

but the repo actually ships a pnpm-lock.yaml, a pnpm-workspace.yaml, a "packageManager": "pnpm@11.0.9" field in package.json, and uses pnpm run / pnpm audit in scripts (e.g. scripts/test.sh, package.json:35). Several open dependabot PRs (#81, #82, #83, #85) are bumping versions against pnpm-lock.yaml. Either the docs are out of date, or the project is half-migrated. Worth a one-off follow-up PR to either move the project back to package-lock.json per the documented choice, or update CONTRIBUTING.md to acknowledge pnpm. Neither outcome blocks this PR — the inconsistency predates it — but flagging it because every dependabot PR inherits the same confusion.

⚪ nit · warranted · .github/dependabot.yml:4

Dependabot is configured for the npm ecosystem (package-ecosystem: "npm") but the project is pnpm-driven, which is why this PR's diff lives entirely in pnpm-lock.yaml. Dependabot's npm ecosystem does not natively manage pnpm-lock.yaml, so the lockfile changes in this PR look like they were generated by a separate bot or manual trigger — worth confirming. If the maintainers intend Dependabot to drive these bumps, the ecosystem needs to be pnpm (or a different tool, like the collective's renovate setup) to actually own pnpm-lock.yaml. Pre-existing misconfiguration — not introduced by this PR — but worth knowing it exists before this and the other four open dependabot PRs are merged.

---

_{🔴 blocking · 🟠 a reviewer would ask for a change · ⚪ optional}

_{Automated code review — correctness, security, design, tests, plus duplicates and scope. A human still decides; this is not a substitute for review and is not exhaustive. The required status checks separately cover lint, formatting, types, unused dependencies, the test suite and the build. This bot never merges. Maintainers can rerun with /re-review.}