chore(deps): bump @types/node from 26.6.2 to 26.6.3 in /clients/typescript

[dependabot]

Bumps @types/node from 26.6.2 to 26.6.3.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

🐳 Agent Server images for this PR — GHCR package, pull/run commands, and all pushed tags (click to expand)

• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server

Variants & Base Images

Variant	Architectures	Base Image	Docs / Tags
java	amd64, arm64	eclipse-temurin:17-jdk	Link
python-slim	amd64, arm64	python-node-runtime	Link
python-minimal	amd64, arm64	python-node-runtime	Link
python	amd64, arm64	python-node-runtime	Link
golang	amd64, arm64	golang:1.21-bookworm	Link

Pull (multi-arch manifest)

# Each variant is a multi-arch manifest supporting both amd64 and arm64
docker pull ghcr.io/openhands/agent-server:d3dc563-python

Run

docker run -it --rm \
  -p 8000:8000 \
  --name agent-server-d3dc563-python \
  ghcr.io/openhands/agent-server:d3dc563-python

All tags pushed for this build

ghcr.io/openhands/agent-server:d3dc563-golang-amd64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-golang-amd64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-golang-amd64
ghcr.io/openhands/agent-server:d3dc563-golang_tag_1.21-bookworm-amd64
ghcr.io/openhands/agent-server:d3dc563-golang-arm64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-golang-arm64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-golang-arm64
ghcr.io/openhands/agent-server:d3dc563-golang_tag_1.21-bookworm-arm64
ghcr.io/openhands/agent-server:d3dc563-java-amd64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-java-amd64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-java-amd64
ghcr.io/openhands/agent-server:d3dc563-eclipse-temurin_tag_17-jdk-amd64
ghcr.io/openhands/agent-server:d3dc563-java-arm64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-java-arm64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-java-arm64
ghcr.io/openhands/agent-server:d3dc563-eclipse-temurin_tag_17-jdk-arm64
ghcr.io/openhands/agent-server:d3dc563-python-amd64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-python-amd64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-python-amd64
ghcr.io/openhands/agent-server:d3dc563-python-node-runtime-amd64
ghcr.io/openhands/agent-server:d3dc563-python-arm64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-python-arm64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-python-arm64
ghcr.io/openhands/agent-server:d3dc563-python-node-runtime-arm64
ghcr.io/openhands/agent-server:d3dc563-python-minimal-amd64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-python-minimal-amd64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-python-minimal-amd64
ghcr.io/openhands/agent-server:d3dc563-python-node-runtime-minimal-amd64
ghcr.io/openhands/agent-server:d3dc563-python-minimal-arm64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-python-minimal-arm64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-python-minimal-arm64
ghcr.io/openhands/agent-server:d3dc563-python-node-runtime-minimal-arm64
ghcr.io/openhands/agent-server:d3dc563-python-slim-amd64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-python-slim-amd64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-python-slim-amd64
ghcr.io/openhands/agent-server:d3dc563-python-node-runtime-slim-amd64
ghcr.io/openhands/agent-server:d3dc563-python-slim-arm64
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-python-slim-arm64
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-python-slim-arm64
ghcr.io/openhands/agent-server:d3dc563-python-node-runtime-slim-arm64
ghcr.io/openhands/agent-server:d3dc563-golang
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-golang
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-golang
ghcr.io/openhands/agent-server:d3dc563-golang_tag_1.21-bookworm
ghcr.io/openhands/agent-server:d3dc563-java
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-java
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-java
ghcr.io/openhands/agent-server:d3dc563-eclipse-temurin_tag_17-jdk
ghcr.io/openhands/agent-server:d3dc563-python-minimal
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-python-minimal
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-python-minimal
ghcr.io/openhands/agent-server:d3dc563-python-node-runtime-minimal
ghcr.io/openhands/agent-server:d3dc563-python-slim
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-python-slim
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-python-slim
ghcr.io/openhands/agent-server:d3dc563-python-node-runtime-slim
ghcr.io/openhands/agent-server:d3dc563-python
ghcr.io/openhands/agent-server:d3dc563bd7daf7fe012aadeee92fdfc45095915c-python
ghcr.io/openhands/agent-server:dependabot-npm-and-yarn-clients-typescript-types-node-26.6.3-python
ghcr.io/openhands/agent-server:d3dc563-python-node-runtime

About Multi-Architecture Support

• Each variant tag (e.g., d3dc563-python) is a multi-arch manifest supporting both amd64 and arm64
• Docker automatically pulls the correct architecture for your platform
• Individual architecture tags (e.g., d3dc563-python-amd64) are also available if needed

[github-actions]

REST API breakage checks (OpenAPI) — ✅ PASSED

Result: ✅ PASSED

Action log

[all-hands-bot]

This review was posted by an AI agent (OpenHands).

Summary

Dependabot bumps @types/node from 26.6.2 to 26.6.3 in clients/typescript/package-lock.json (+3/-3: version, resolved, integrity). The diff itself is correct and complete:

• The resolved URL and integrity (sha512-dsqMQQoeTLqu9wynDD00q573mNzso3IdQOAfHRJqLCcmCFPoGo9A1bDpUcv/9tnKpErQWv9uKeGfl37EIS02Yg==) match the npm registry metadata for 26.6.3 exactly.
• 26.6.3 stays within the declared ^26.1.0 devDependency range, and its only dependency (undici-types ~8.9.0) is already resolved at 8.9.0, so no transitive change is pulled in.
• The package is dev-only and the client is browser-targeted, so there is no production runtime impact.

Verification performed

• Scope: in scope - clients/typescript/ owns the TypeScript client and its lockfile, and .github/dependabot.yml configures the npm ecosystem for that directory.
• Local checks on exact head d3dc563: npm ci, npm run lint (0 errors), npm run build, and npm run test:coverage (23 files, 347 tests) all pass.
• Current-head CI: all required checks pass, including TypeScript client CI, TypeScript client integration tests, TypeScript client endpoint audit, Run tests, Pre-commit checks, and Review Thread Gate.
• No linked issues, no existing review threads, and no prior review comments on this PR.

Supply-chain checkpoint (repository guidance)

.agents/skills/custom-codereview-guide.md (Dependency updates) requires inspecting the changed distribution's package-index upload time and not approving an artifact uploaded less than seven days ago, instead stating the package, version, and upload time and asking a maintainer whether to wait or override the guardrail. This artifact is still inside that window:

• Package: @types/node
• Version: 26.6.3
• npm upload time: 2026-09-25T22:06:16Z
• Age at review: ~6.3 days

The code change has no defect; this hold is about artifact age only. Note the asymmetry that produced the same hold on the previous @types/node bump (PR #5301): .github/dependabot.yml sets cooldown.default-days: 7 for the uv ecosystem but sets no cooldown for the npm ecosystem (/clients/typescript), so npm bumps bypass the seven-day freshness window the repository applies to its Python workspace via pyproject.toml tool.uv.exclude-newer = "7 days".

A maintainer should decide whether to wait until the artifact clears seven days, merge now with an explicit override, or add a matching cooldown to the npm Dependabot entry so future npm bumps are held automatically.

🔄 CHANGES REQUESTED