fix: pin @types/node to CI runtime major and block dependabot major bumps

- Add ignore rule in dependabot.yml for @types/node semver-major updates
- Pin @types/node from ^25 to ^24 (matches node-version in CI workflow)
- Sanctioned exception to the no-blanket-ignore rule: @types/node must
  track the runtime Node major, and Dependabot cannot detect the runtime
- Confirmed tsc and cdk synth pass with the pinned version

Closes #3

.github/dependabot.yml

@@ -6,6 +6,14 @@ updates:
       interval: weekly
     assignees:
       - amoussa1229
+    ignore:
+      # @types/node must track the runtime Node major, not the latest release.
+      # Pure-CDK repo: the runtime is the Node that runs `cdk synth`/`tsc` in CI.
+      # Dependabot can't see that and a too-new types major still compiles (passes
+      # CI, wrong at runtime). Sanctioned exception to the no-blanket-ignore rule
+      # (engineering-handbook github-standards Pinning Principle). Minor/patch flow.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
 
   - package-ecosystem: github-actions
     directory: /

package-lock.json

@@ -15,7 +15,7 @@
         "app": "bin/app.js"
       },
       "devDependencies": {
-        "@types/node": "^25.9.3",
+        "@types/node": "^24",
         "aws-cdk": "^2.1128.1",
         "source-map-support": "^0.5.21",
         "typescript": "~6.0.3"
@@ -70,13 +70,13 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "25.9.4",
+      "version": "24.13.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.4.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.2.tgz",
-      "integrity": "sha512-dszCsrKb5U7ZsVZBWiHFklTloVl0mSEnWH/iZXfZUlI4rzCUnsvGmgqfuVRHL54ugE7/wRuxEIXRa2iMZ+BG6g==",
+      "integrity": "sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "undici-types": ">=7.24.0 <7.24.7"
+        "undici-types": "~7.18.0"
       }
     },
     "node_modules/aws-cdk": {
@@ -511,9 +511,9 @@
       }
     },
     "node_modules/undici-types": {
-      "version": "7.24.6",
+      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "dev": true,
       "license": "MIT"
     }

package.json

@@ -12,7 +12,7 @@
     "diff": "cdk diff"
   },
   "devDependencies": {
-    "@types/node": "^25.9.3",
+    "@types/node": "^24",
     "aws-cdk": "^2.1128.1",
     "source-map-support": "^0.5.21",
     "typescript": "~6.0.3"