chore(deps): upgrade @types/node 20.19.31 → 26.1.1

[devin-ai-integration]

Summary

Bumps the @types/node devDependency six majors (Node 20 typings → Node 26 typings). No source changes were needed — the Node typings are only pulled into the Vitest/spec compilation unit (tsconfig.spec.json → "types": ["node"]) and the Cypress unit (src/test/javascript/cypress/tsconfig.json → "types": ["cypress", "node"]); the Angular app build (tsconfig.app.json) declares "types": ["@angular/localize"], so app code never sees the Node globals. Nothing in src/main/webapp, webpack/ (all .js, not .ts), cypress*.config.ts, or vitest-base.config.ts touches an API whose typing changed in the 20→26 delta.

Coordinate diff

 // package.json (devDependencies)
-"@types/node": "20.19.31",
+"@types/node": "26.1.1",

 // package-lock.json — transitive companion moved by the new major
-"undici-types": "~6.21.0"   // 6.21.0
+"undici-types": "~8.3.0"    // 8.3.0

26.1.1 is the newest stable 26.x on the live npm registry (published 2026-07-08, >7 days old); 26.1.0/26.0.x are older, and there are no non-prerelease versions above it in the 26 line.

Resolution proof (no split / no downgrade)

$ ./npmw ls @types/node --all | grep -o "@types/node@[0-9.]*" | sort -u
@types/node@26.1.1

Every one of the ~20 transitive consumers (ts-node, @types/express*, @types/ws, @inquirer/*, webpack-dev-server, …) dedupes onto the single hoisted 26.1.1. Lockfile diff is confined to the @types/node and undici-types entries — no lockfile-wide churn.

Override / peer pin

None needed. No peer-dependency constraint in the tree caps @types/node, and node.version in pom.xml was not touched — the typings did not require a runtime Node bump (the box's local Node 24.13.0, as pinned by the frontend-maven-plugin, builds and tests fine against Node 26 typings, since @types/node majors track typing surface rather than requiring a matching runtime).

API migration

Explicitly none. Grep for the literal old version string 20.19.31 across the repo (excluding node_modules/target) matched only package.json and package-lock.json, both updated. No docs, CI workflow, or config file referenced the old version.

Gate output

Command set: ./npmw run lint + ./npmw test (Vitest) + ./mvnw verify.

Gate	Baseline (untouched main)	After bump
./npmw run lint (eslint)	exit 0, 0 problems	exit 0, 0 problems
./npmw test (Vitest)	80 test files, 401 tests passed	80 test files, 401 tests passed
./mvnw verify	BUILD SUCCESS — Tests run: 163, Failures: 0, Errors: 0, Skipped: 0	BUILD SUCCESS — Tests run: 163, Failures: 0, Errors: 0, Skipped: 0

Vitest after the bump:

 Test Files  80 passed (80)
      Tests  401 passed (401)

./mvnw verify also runs npm run webapp:build (ng build --configuration development), so the Angular AOT/type-check pass is covered by the gate and is green.

Pre-existing on base, not addressed here

Both verified by re-running the identical command on clean main (git stash → npm install → run → git stash pop); output was byte-identical before and after the bump:

1. tsc -p src/test/javascript/cypress/tsconfig.json --noEmit reports 20 errors — TS7034/TS7005 implicit-any on user/authority/bankAccount/label/operation in the *.cy.ts specs, TS18048 possibly-undefined response, and TS2306/TS2339/TS7010 from cypress-audit's non-module index.d.ts and the lighthouse report generator in plugins/index.ts. This standalone tsc invocation is not part of the gate; the error list is identical on base, so none of it is attributable to the typings bump.
2. Maven enforcer DependencyConvergence warning on org.apache.commons:commons-text (1.13.1 via liquibase-core → opencsv vs 1.14.0 direct from liquibase-core). Warning-only, does not fail the build, and is unchanged on base — Java-side, explicitly out of scope.
3. npm audit reports 115 vulnerabilities in the existing dependency tree. Unchanged by this PR (the two changed packages are dev-only type declarations); fixing it would require lockfile-wide bumps, which are out of scope for a one-dependency PR.

Environment note (not a repo defect): the box's default JDK is 17, which trips the JHipster enforcer rule "JHipster supports JDK 21 to 25". All Maven runs above — baseline and post-change alike — used JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/0ac64a2d5bee4b4b9bf5fd7da864cae9
Requested by: @mbatchelor81

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring