Bump @types/node from 24.12.2 to 24.13.3

[dependabot]

Bumps @types/node from 24.12.2 to 24.13.3.

Commits

• See full diff in compare view

[fossabot]

✓ Safe to upgrade

I recommend merging this upgrade because this is a minor patch-level bump of a development-only type definitions package, and the codebase is well-insulated from its changes. The project's tsconfig.json explicitly sets skipLibCheck: true, which bypasses type-checking in all .d.ts files and shields the build from any breaking type-signature changes in this release (such as the http2 frameError listener signature update, Domain.members type narrowing, or fs.promises.write() Stream removal). The only APIs actually used in the codebase — process.env, process.platform, fs.createWriteStream, and the Buffer type — were not affected by this upgrade. The TypeScript minimum version requirement increase (from 5.3 to 5.6) does not impact this project, which already requires TypeScript ^5.9.3. Web search findings about the noDeprecation Electron compatibility issue and the TypeScript 6.0 types configuration change are both irrelevant to this project. No security vulnerabilities were identified.

What we checked

• @​types/node is declared as ^24.13.3 in devDependencies, confirming it is a type-checking-only dependency with no runtime impact. ^[1]
• skipLibCheck: true is set, which skips type-checking of all .d.ts files including @​types/node. This insulates the project from any breaking type signature changes in this upgrade (e.g., http2 frameError listener signatures, Domain.members narrowing, fs.promises.write() Stream removal). ^[2]
• TypeScript is declared as ^5.9.3, which exceeds the new minimum TypeScript version requirement (5.6) introduced in this @​types/node release. No TypeScript compiler upgrade is needed. ^[3]
• The only Node.js built-in imported directly is node:fs (import * as fs from 'node:fs'). Usage is limited to fs.createWriteStream, which was not affected by changes in this release. ^[4]
• process.env and process.platform are the only process globals used in the codebase. Neither of these were modified by the upgrade; the new process.traceProcessWarnings addition is purely additive. ^[5]
• The noDeprecation optional property conflict affects Electron projects. This repository is a GitHub Action (not an Electron app), so this compatibility issue does not apply. ^[6]
• The TypeScript 6.0 requirement to explicitly set "types": ["node"] in tsconfig.json does not apply here — this project uses TypeScript ^5.9.3, not TypeScript 6.0. ^[7]

Dependency Usage

No usage of the analyzed dependencies was found in this repository.

• The only Node.js built-in imported directly is node:fs (import * as fs from 'node:fs'). Usage is limited to fs.createWriteStream, which was not affected by changes in this release.
  

  fossa-action/src/download-cli.ts

  Line 4 in 1170615

  import * as fs from 'node:fs';

• process.env and process.platform are the only process globals used in the codebase. Neither of these were modified by the upgrade; the new process.traceProcessWarnings addition is purely additive.
  

  fossa-action/src/index.ts

  Line 73 in 1170615

  const PATH = process.env.PATH || '';

Changes

@​types/node was updated with 6 breaking changes requiring developer attention: ServerResponse frameError event listeners now require a third id: number parameter, Domain.members and Domain.add() no longer accept NodeJS.Timer types, SQLTagStore.size changed from a method to a readonly property (update size() calls to size), requestOCSP moved from ConnectionOptions to SecureConnectOptions, and fs.promises.write() no longer accepts Stream objects as the data parameter.

• ServerResponse frameError event listener signature changed - now requires a third parameter 'id: number'. The listener signature changed from (frameType: number, errorCode: number) => void to (frameType: number, errorCode: number, id: number) => void in addListener, emit, on, once, prependListener, and prependOnceListener methods. (v24.12.4, package source)
• Domain.members type changed from Array<EventEmitter | NodeJS.Timer> to EventEmitter[] - Timer type no longer supported (v24.13.0, package source)
• Domain.add() method signature changed from add(emitter: EventEmitter | NodeJS.Timer) to add(emitter: EventEmitter) - Timer type no longer accepted (v24.13.0, package source)

View 25 more changes

• SQLTagStore.size changed from method size() to readonly property size - callers must change from size() call to property access (v24.13.0, package source)
• requestOCSP option moved from ConnectionOptions interface to SecureConnectOptions interface in tls module (v24.13.0, package source)
• Removed Stream type support from fs.promises.write() method - the data parameter no longer accepts Stream objects. Code passing Stream instances to write() will fail type checking. (v24.13.3, package source)
• Updated http2 'sessionError' event listener signatures to include session parameter. The listener callbacks for addListener, emit, on, once, prependListener, and prependOnceListener on ServerHttp2SecureServer now correctly include the session parameter: listener: (err: Error, session: ServerHttp2Session) => void. This corrects the type definitions to match actual Node.js http2 behavior. (v24.12.3, package source)
• Updated http2 'sessionError' event listener signatures on ServerHttp2Server (non-secure variant) to include the session parameter in listener callbacks across all event registration methods (addListener, emit, on, once, prependListener, prependOnceListener). (v24.12.3, package source)
• Added process.traceProcessWarnings property to enable/disable warning stack trace tracing at runtime (v24.13.0, package source)
• Added noDelay, keepAlive, keepAliveInitialDelay, and blockList optional properties to net.SocketConnectOpts interface (v24.13.0, package source)
• Added 'error' event listener overloads to readline.Interface for event handling (v24.13.0, package source)
• Added 'secure' event listener overloads to tls.TLSSocket for TLS connection security events (v24.13.0, package source)
• Added Symbol.dispose() method to v8.GCProfiler for resource cleanup in using statements (v24.13.0, package source)
• Added fullName property to test.SuiteContext providing hierarchical suite name with parent chain (v24.13.0, package source)
• Added customSettings property to Settings interface for HTTP/2 session configuration - allows custom HTTP/2 settings via key-value pairs (v24.13.1, package source)
• Added maxSessionRejectedStreams option to ServerSessionOptions interface for HTTP/2 server session configuration (v24.13.1, package source)
• Added optional :protocol pseudo-header property to HTTP/2 headers interface for enhanced protocol specification support (v24.13.2, package source)
• Enhanced fs.promises.appendFile() to accept more data types: now supports Iterable<string | NodeJS.ArrayBufferView> and AsyncIterable<string | NodeJS.ArrayBufferView> in addition to string and NodeJS.ArrayBufferView. (v24.13.3, package source)
• Enhanced standalone appendFile() function with expanded data type support for Iterable and AsyncIterable inputs. (v24.13.3, package source)
• Updated process.argv documentation to clarify handling of program entry points (v24.13.0, package source)
• Removed @​experimental tag from v8.queryObjects() function (v24.13.0, package source)
• Enhanced SQLTagStore documentation with detailed examples and parameter binding explanations (v24.13.0, package source)
• Added security considerations documentation to url.fileURLToPath() regarding directory traversal protection (v24.13.0, package source)
• Updated test.MockTimers.setTime() parameter documentation and provided improved example (v24.13.0, package source)
• Removed JSDoc comments from module.InitializeHook, ResolveHookContext, ResolveFnOutput, and related hook types (documentation cleanup) (v24.13.0, package source)
• Updated inspector module to reorder namespace definitions for better organization (no API changes) (v24.13.0, package source)
• Updated undici-types dependency from ~7.16.0 to ~7.18.0 (v24.13.0, package source)
• TypeScript version requirement increased from 5.3 to 5.6 - users on older TypeScript versions may need to upgrade their TypeScript compiler. (v24.13.3, package source)

References (7)

[1]: @​types/node is declared as ^24.13.3 in devDependencies, confirming it is a type-checking-only dependency with no runtime impact.

fossa-action/package.json

Line 23 in 1170615

"@types/node": "^24.13.3",

[2]: skipLibCheck: true is set, which skips type-checking of all .d.ts files including @​types/node. This insulates the project from any breaking type signature changes in this upgrade (e.g., http2 frameError listener signatures, Domain.members narrowing, fs.promises.write() Stream removal).

fossa-action/tsconfig.json

Line 23 in 1170615

"skipLibCheck": true, // Disables typechecking in `*.d.ts` files. TODO(leo): Remove this after `github` upgrade.

[3]: TypeScript is declared as ^5.9.3, which exceeds the new minimum TypeScript version requirement (5.6) introduced in this @​types/node release. No TypeScript compiler upgrade is needed.

fossa-action/package.json

Line 37 in 1170615

"typescript": "^5.9.3"

[4]: The only Node.js built-in imported directly is node:fs (import * as fs from 'node:fs'). Usage is limited to fs.createWriteStream, which was not affected by changes in this release.

fossa-action/src/download-cli.ts

Line 4 in 1170615

import * as fs from 'node:fs';

[5]: process.env and process.platform are the only process globals used in the codebase. Neither of these were modified by the upgrade; the new process.traceProcessWarnings addition is purely additive.

fossa-action/src/index.ts

Line 73 in 1170615

const PATH = process.env.PATH || '';

[6]: The noDeprecation optional property conflict affects Electron projects. This repository is a GitHub Action (not an Electron app), so this compatibility issue does not apply. (source link)

[7]: The TypeScript 6.0 requirement to explicitly set "types": ["node"] in tsconfig.json does not apply here — this project uses TypeScript ^5.9.3, not TypeScript 6.0. (source link)

---

fossabot analyzed this PR using dependency research. View this analysis on the web

[fossabot]