From 0eff9ff8299bd53dffe745c7f5e9262faff92160 Mon Sep 17 00:00:00 2001
From: "seahaven-openswe[bot]"
 <296972425+seahaven-openswe[bot]@users.noreply.github.com>
Date: Sat, 4 Jul 2026 01:48:51 -0400
Subject: [PATCH] fix: pin @types/node to CI runtime major and block Dependabot
 major bumps (#40)

---
 .github/dependabot.yml |  8 ++++++++
 package-lock.json      | 16 ++++++++--------
 package.json           |  2 +-
 3 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ff0149c..325f014 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,14 @@ updates:
       interval: weekly
     assignees:
       - amoussa1229
+    ignore:
+      # @types/node must track the runtime Node major, not the latest release.
+      # Pure-CDK repo: the runtime is the Node that runs `cdk synth`/`tsc` in CI.
+      # Dependabot can't see that and a too-new types major still compiles (passes
+      # CI, wrong at runtime). Sanctioned exception to the no-blanket-ignore rule
+      # (engineering-handbook github-standards Pinning Principle). Minor/patch flow.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /
diff --git a/package-lock.json b/package-lock.json
index 4df71b2..5553a62 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,7 +16,7 @@
         "app": "bin/app.js"
       },
       "devDependencies": {
-        "@types/node": "^25.9.3",
+        "@types/node": "^24",
         "aws-cdk": "^2.1129.0",
         "source-map-support": "^0.5.21",
         "typescript": "~6.0.3"
@@ -84,13 +84,13 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "25.9.3",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.3.tgz",
-      "integrity": "sha512-603BddQMv3pUcr4U2dhujk83N2tTDVr/34wII2B6bJy6g+8WD6yUb11jszNs0gdi4PesVWl7ABt8nYMVpnLUcg==",
+      "version": "24.13.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.2.tgz",
+      "integrity": "sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "undici-types": ">=7.24.0 <7.24.7"
+        "undici-types": "~7.18.0"
       }
     },
     "node_modules/aws-cdk": {
@@ -525,9 +525,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "7.24.6",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
-      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "dev": true,
       "license": "MIT"
     }
diff --git a/package.json b/package.json
index 2e64877..4eb2541 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,7 @@
     "diff": "cdk diff"
   },
   "devDependencies": {
-    "@types/node": "^25.9.3",
+    "@types/node": "^24",
     "aws-cdk": "^2.1129.0",
     "source-map-support": "^0.5.21",
     "typescript": "~6.0.3"