[dependabot]

Updates the resolved @types/node version from 26.6.1 to 26.6.5 in package.json and the generated lockfile; this is a development-dependency type update. No application source changes are included.

Canonical requirement

• Canonical Issue URL: chore(governance): enforce revisioned Issue requirements and acceptance ledgers #95
• Consumed revision: R1
• No automatic close keywords: acknowledged

Delivery ownership

• implementationOwner: @dependabot
• automatedPreReviewOwner: Dependabot compatibility and hosted CI
• humanReviewOwner: @PeterGuy326
• Separation of duties: the bot authors the dependency update; a non-author human reviewer owns the final review.

Requirement trace

REQ/AC IDs	Changed files / domain	Tests or review evidence
REQ-382 / AC-382	the resolved @types/node version 26.6.1 to 26.6.5 update in package.json and package-lock.json	Hosted Node 20/22/24 CI, coverage, package-consumer, container, distribution, dependency review, CodeQL, and security checks on the exact PR head

File domains

• the resolved @types/node version 26.6.1 to 26.6.5 update in package.json and package-lock.json; no application runtime source is changed.

Scope and non-goals

This PR updates only the the resolved @types/node version development dependency resolution in package.json and package-lock.json. It does not change product behavior, APIs, data formats, or release policy beyond the stated dependency/action update.

Validation

• Exact commands: hosted workflow command npm test; governance command npm run governance:check -- --github-event-file "$GITHUB_EVENT_PATH".
• Observed counts/results: NOT VERIFIED: hosted checks will be rerun after this PR trace is restored.
• Check URLs: https://github.com/bytefolk/digital-employee/pull/382/checks

ID	REQ/AC	Observable acceptance criterion	Command or manual steps	Environment	Expected	Observed	Status
V1	AC-382	Dependency and workflow files resolve across supported Node versions.	Hosted GitHub Actions CI matrix	Node 20, 22, and 24 GitHub-hosted runners	Required checks pass on exact head.	NOT VERIFIED: hosted checks will be rerun after this body update.	NOT VERIFIED

Security and compatibility

The change is a within-range patch update of a development-only type package and leaves runtime packages, workflow permissions, publication policy, and application code unchanged. Hosted dependency review and the supported Node-version matrix remain required.

Known limitations

The governance-only failed jobs must be rerun after restoring this body. No local result substitutes for required hosted checks.

Risk and rollback

Risk is limited to TypeScript type-check compatibility. Rollback is the two-file manifest/lockfile revert; there is no data migration or irreversible side effect.

Product review handoff

• Automated pre-review result: PASS: Dependabot generated a dependency-only update.
• Human final review: PENDING
• Merge ledger owner: @PeterGuy326
• Product reviewer: @PeterGuy326
• Milestone or release packet: N/A: dependency maintenance PR; no separate product packet.
• Merge, CI, release, and model judgment do not accept or close the Issue: acknowledged

[PeterGuy326]

Automated maintainer triage (PeterGuy326 duty rotation). Blocked — no action needed from the author.

Blocker: governance:check → pull-request-trace-check. The three required test (20|22|24) legs fail only at npm run governance:check; typecheck, build and the unit suites pass. The failure is the nine-heading PR-body contract, which a Dependabot body cannot satisfy:
Canonical requirement, Requirement trace, File domains, Scope and non-goals, Validation, Security and compatibility, Known limitations, Risk and rollback, Product review handoff (plus a full GitHub Issue URL, an R<n> consumed revision, and the no-auto-close acknowledgement).

All other required checks are green (container, coverage, CodeQL (javascript-typescript), Dependency review, OpenSSF Scorecard).

This is a @types/node dev-dependency patch bump (26.6.1 → 26.6.5). It will remain blocked until the Dependabot governance exemption (approved by the duty rotation on 2026-10-14, scope limited to the requirement-trace check only) is implemented in CI. Same class as #373–#381; #381 was closed by Dependabot when this PR superseded it.