chore(deps): consolidate dependabot bumps with flake hash update

[clay-good]

Replaces #1448, #1451, #1452 and #1453 with one lockfile resolution, following the pattern set by #1427.

Why consolidate

All four PRs change pnpm-lock.yaml, and flake.nix pins a content hash of the pnpm dependency set. Merging them serially would invalidate that hash four times, requiring four regenerations and three rebases. Dependabot cannot update Nix files, which is why all four were red on Nix Flake Validation.

What's in it

Package	From	To	Source
typescript (dev)	5.9.3	6.0.3	#1452
ora	8.2.0	9.4.1	#1453
commander	14.0.0	14.0.3	#1448 (lockfile only)
posthog-node	5.46.0	5.46.1	#1448 (lockfile only)
@types/node (dev)	24.2.0	20.19.43	see below — downgrade, not a bump

commander and posthog-node move in the lockfile only — their package.json ranges are unchanged, matching #1448 exactly.

@types/node: aligned to the runtime floor instead of bumped

Per review feedback from @alfred-openspec, @types/node is now pinned to ^20.19.43 — the latest release in the line matching engines.node: ">=20.19.0" — rather than taking dependabot's 26.

The concern is real: compiling against newer Node declarations lets the type checker accept APIs that don't exist on the runtimes we actually support, so a Node 22+ call would type-check and then fail for users on Node 20.

Note this also corrects pre-existing drift: main was already on @types/node 24 against the same 20.19 floor, so the types were ahead of the supported runtime before this PR. This is the first time they line up.

Worth recording that CI already runs the whole matrix on Node 20.19.0 exactly, so runtime behaviour was being validated at the floor — the gap was purely at type-check time, which is what this closes.

Proof it works

• npm run build — clean
• npx tsc --noEmit — 0 errors
• npm run lint — 0 errors
• Full suite — 112 files / 2253 tests passing, identical to the origin/main baseline
• Compiled output is byte-identical to origin/main: diffing dist/ yields 0 differing .js or .d.ts files. Despite a TypeScript major and a @types/node major move, every user receives bit-for-bit the same shipped JavaScript and type declarations.
• No peer-dependency warnings on install
• End-to-end smoke test of the runtime deps (ora spinners, commander parsing): --version, --help, init, update, list --json, validate all behave correctly
• All 15 CI checks green, including Nix Flake Validation and the linux/macOS/Windows matrix

ora@9 requires node >=20, satisfied by the >=20.19.0 floor, so no supported user loses support.

Excluded: #1450 (@inquirer/prompts 8)

Deliberately left out — it needs a code migration, not a version bump:

1. checkbox's instructions option was removed in v8, breaking src/commands/config.ts:587 (error TS2353).
2. More significantly, @inquirer/prompts@8 requires @inquirer/core@^11, but OpenSpec depends on @inquirer/core@^10.3.2 directly — src/ui/welcome-screen.ts and src/prompts/searchable-multi-select.ts build custom prompts on createPrompt, useState, useKeypress, useMemo, usePrefix, isEnterKey, isBackspaceKey, isUpKey, isDownKey. Bumping only prompts would put two copies of @inquirer/core in the tree, with custom prompts on v10 and bundled prompts on v11.

Closed and tracked in #1458.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Updates @types/node, TypeScript, and ora versions in package.json, then refreshes the Nix pnpmDeps fetch hash.

Changes

Tooling and dependency updates

Layer / File(s)	Summary
Package version updates package.json	Updates @types/node to ^20.19.43, typescript to ^6.0.3, and ora to ^9.4.1.
Nix dependency pin refresh flake.nix	Updates the pnpmDeps fetcher hash for the dependency source.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• Fission-AI/OpenSpec#1249: Both updates refresh the pnpmDeps hash and modify package dependencies.
• Fission-AI/OpenSpec#1427: Both updates refresh the flake.nix pnpmDeps fetch hash alongside package dependency changes.

Suggested reviewers: tabishb, alfred-openspec

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the dependency bump consolidation and the flake hash update.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-consolidated-2026-07-27

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[alfred-openspec]

The consolidated lockfile and Nix hash are green, but this still carries @types/node 26 while OpenSpec supports Node 20.19. Please keep the Node types aligned with the supported runtime floor (or raise that floor with compatibility evidence), since compiling against Node 26 declarations can admit APIs unavailable to supported users.

[clay-good]

@alfred-openspec — good catch, and agreed. Fixed in e4c0ae5.

@types/node is now pinned to ^20.19.43, the latest release in the line matching engines.node: ">=20.19.0", rather than dependabot's 26.

I took the "keep the Node types aligned with the supported runtime floor" option rather than raising the floor. Two things worth flagging that came out of doing it:

1. This also fixes pre-existing drift, not just the drift this PR would have added. main was already on @types/node 24 against the same 20.19 floor — so the types were ahead of the supported runtime before this PR. Going to 26 would have widened an existing gap rather than opening a new one. Pinning to 20.19.43 is the first time the two actually line up, so this is a small net improvement over main.

2. The exposure was type-check-only, not runtime. CI already runs the full test matrix on Node 20.19.0 exactly (node-version: '20.19.0' in all three jobs in ci.yml), so a Node 22+ API on a covered path would have failed at runtime in CI. What was missing was the compile-time guard for uncovered paths — which is precisely the hole you identified, and what this closes.

Verification of the downgrade

Since dropping two major versions of type declarations can surface errors, I checked it rather than assuming:

• npx tsc --noEmit — 0 errors
• npm run build — clean
• npm run lint — 0 errors
• Full suite — 112 files / 2253 tests passing
• dist/ byte-identical to origin/main — 0 differing .js/.d.ts files
• No peer-dependency warnings on install
• All 15 CI checks green

One knock-on

The realigned lockfile pulls undici-types@6.21.0, which changed the pnpm dependency set again, so the flake.nix pnpmDeps hash needed regenerating a second time (2d46c5d → sha256-gDQ8jDwWfK8feX8PXB7acWvMITWsq/+a+eQ8N+I/iRg=). Nix Flake Validation is green on the current head.

The PR description has been updated to reflect that @types/node is now a downgrade relative to main, not a bump, so the changelog doesn't misrepresent it.

If you'd rather keep this PR strictly to the dependabot bumps and handle the 24 → 20.19 realignment separately, say the word and I'll revert that commit to ^24.2.0 — but since 26 was the thing you objected to, aligning fully seemed like the more useful answer.

[alfred-openspec]

Re-reviewed at 10611b5. The Node declarations now match the supported Node 20.19 floor, the regenerated Nix hash is green, and the frozen install, production audit, build, typecheck, lint, 2,255-test suite, and all CI checks pass.