Update lockfile for @types/node 24.13.3

Release-Bump: minor

.gitea/workflows/registry-cleanup.yml

@@ -19,4 +19,4 @@ jobs:
         run: |
           docker run --rm -v "$PWD:/repo" -w /repo \
             -e REGISTRY_TOKEN -e REGISTRY_USER -e REPO_TOKEN -e REPOSITORY -e SERVER_URL \
-            node:24.18.0-alpine3.24 node registry-cleanup/cleanup.ts
+            node:24.18.1-alpine3.24 node registry-cleanup/cleanup.ts

.gitea/workflows/renovate.yml

@@ -52,7 +52,7 @@ jobs:
           fi
           BUMPS=$(git log "${LATEST}..origin/main" --author='renovate@larvit.se' \
                   --format='%(trailers:key=Release-Bump,valueonly)' | { grep -vx '' || true; })
-          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:24.16.0-alpine3.24 \
+          NEXT=$(docker run --rm -v "$PWD:/repo" -w /repo node:24.18.1-alpine3.24 \
                  node auto-release/next-version.ts "$LATEST" $BUMPS)
           echo "Releasing $LATEST -> $NEXT"
           git tag "$NEXT" origin/main

AGENTS.md

@@ -7,7 +7,7 @@ commands and layout.
 
 Use the file `todo.md`.
 
-For each todo item, interview the user extensively to deeply understand the scope and goal of each. When done, run the stability reviewer agent in a loop and address all feedback until there is none. If you are not very confident of how to address it, ask the user. Check the completed task in this file. Commit all changes and push to a new branch, create a PR and merge it when the CI/CD turns green.
+For each todo item, interview the user extensively to deeply understand the scope and goal of each. When done, check the completed task in `todo.md`. Commit all changes and push to a new branch, create a PR and merge it when the CI/CD turns green.
 
 ## Project priorities (do not erode)
 
@@ -170,9 +170,8 @@ Same test before adding a row to a table or the file map — a clause, not a par
   that re-parses `ctx.url.pathname`: it duplicates the URL shape, ignores the router's params, and
   has to re-handle HEAD. Factor shared per-request setup (auth gate, `ctx.system` capability
   resolution, target fetch) into a small `withX` wrapper — see `examples/plugins/admin/`.
-- Run the stability reviewer agent after every implementation of something that can be like
+- Reviews are maintainer-triggered (e.g. via the larv-review skill) — never auto-run reviewer
-  a PR. That includes any change pushed directly to main.
+  agents. Decided 2026-08-02, replacing the earlier run-after-every-implementation rule.
-  Skip this if the changes are purely documentation and/or comments.
 - Use well formed, standard compliant, rich URIs. Prefer state in the URL over POST:ing in for
   for example list pages with filters and pagination. Do: "ids=x&ids=y" and not "ids[]=x&ids[]=y"
   and not "ids=x,y".

Dockerfile

@@ -1,5 +1,5 @@
 # Node 24 runs TypeScript directly (type stripping) — no build step. Pinned exact tag.
-FROM node:24.18.0-alpine3.24
+FROM node:24.18.1-alpine3.24
 
 WORKDIR /app
 

compose.override.yml

@@ -27,7 +27,7 @@ services:
   # backs it (SCHEDULING_UPSTREAM above points here). Stand-in for the customer's real service —
   # stdlib-only, in-memory, no auth. Prod points SCHEDULING_UPSTREAM at the real backend instead.
   shifts-upstream:
-    image: node:24.18.0-alpine3.24
+    image: node:24.18.1-alpine3.24
     command: node /srv/server.ts
     restart: unless-stopped
     volumes:

e2e-tests/compose.full.yml

@@ -54,7 +54,7 @@ services:
 
   # The reference plugin's upstream (examples/shifts-upstream) so /scheduling/shifts shows real rows.
   shifts-upstream:
-    image: node:24.18.0-alpine3.24
+    image: node:24.18.1-alpine3.24
     command: ["node", "/server.ts"]
     volumes:
       - ./examples/shifts-upstream/server.ts:/server.ts:ro
@@ -67,7 +67,7 @@ services:
   # Mock OIDC provider for the SSO login test — stdlib Node, auto-approves, signs an id_token Kratos
   # verifies via its jwks. Reachable as the same host (mock-oidc:9000) by both the browser and Kratos.
   mock-oidc:
-    image: node:24.18.0-alpine3.24
+    image: node:24.18.1-alpine3.24
     command: ["node", "/mock-oidc.ts"]
     environment:
       ISSUER: http://mock-oidc:9000
@@ -82,7 +82,7 @@ services:
 
   # Same-origin gateway: Kratos-owned paths → kratos, everything else → web (e2e-tests/proxy.ts).
   proxy:
-    image: node:24.18.0-alpine3.24
+    image: node:24.18.1-alpine3.24
     command: ["node", "/proxy.ts"]
     depends_on:
       web:

package-lock.json

@@ -14,7 +14,7 @@
       },
       "devDependencies": {
         "@types/ejs": "3.1.5",
-        "@types/node": "24.13.2",
+        "@types/node": "24.13.3",
         "typescript": "5.9.3"
       },
       "engines": {
@@ -38,9 +38,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "24.13.2",
+      "version": "24.13.3",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.2.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
-      "integrity": "sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==",
+      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

package.json

@@ -24,7 +24,7 @@
   },
   "devDependencies": {
     "@types/ejs": "3.1.5",
-    "@types/node": "24.13.2",
+    "@types/node": "24.13.3",
     "typescript": "5.9.3"
   }
 }