chore(deps): bump @humanfs/node from 0.16.6 to 0.16.8

[dependabot]

Bumps @humanfs/node from 0.16.6 to 0.16.8.

Release notes

Sourced from @​humanfs/node's releases.

node: v0.16.8

0.16.8 (2026-04-17)

Bug Fixes

• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

node: v0.16.7

0.16.7 (2024-11-27)

Bug Fixes

• Add directory to package.json (f691b60)

Changelog

Sourced from @​humanfs/node's changelog.

0.16.8 (2026-04-17)

Bug Fixes

• Ensure symlinks are copied as symlinks in copy() and copyAll() (22bbaa44)
• Include type dependencies at runtime (956ce7a), closes #145

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​humanfs/core bumped from ^0.19.1 to ^0.19.2

0.16.7 (2024-11-27)

Bug Fixes

• Add directory to package.json (f691b60)

Commits

• e96070e chore: release main (#146)
• 22bbaa4 Merge commit from fork
• 956ce7a fix: Include type dependencies at runtime
• 257b7b5 chore: release main (#142)
• f691b60 fix: Add directory to package.json
• 7b81d9a chore(deps): Upgrading retry dependency in node package. (#140)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[joshuanapoli]

Summary

Bumps @humanfs/node 0.16.6 -> 0.16.8 (and its transitive @humanfs/core 0.19.1 -> 0.19.2, adding @humanfs/types 0.15.0). Lockfile/PnP-cache only; no source or manifest changes.

Risks

Low.

• @humanfs/node is not a direct dependency and is not referenced anywhere in src/. It reaches us only through eslint@10.0.3 ("@humanfs/node": "npm:^0.16.6"), which is a devDependency. Nothing in the runtime dependency set (axios, commander) pulls it in, so the shipped CLI is unaffected.
• The upstream changes are a symlink-preservation fix in copy()/copyAll() (security fix merged from a fork) and moving type deps to runtime. ESLint uses this package only for reading config/source files, so neither behavior is on a path we depend on.
• Side effect worth noting: the duplicate @humanwhocodes/retry@0.3.1 entry is dropped, because 0.16.8 widens its range to ^0.4.0 and now dedupes onto the existing 0.4.3. This removes a package version rather than adding one.

Analysis

• Reviewed the release notes and the commit list for node-v0.16.6...node-v0.16.8.
• Diffed yarn.lock against main: the change is confined to the @humanfs/* and @humanwhocodes/retry blocks, with no unrelated resolution drift.
• Traced reverse dependencies in the lockfile to confirm dev-only, transitive usage.
• CI (test job, workflow CI) ran against the current head commit 4efd84f and passed. That job runs yarn install --immutable --immutable-cache, which validates the lockfile and the Yarn PnP zip cache in this diff, then prettier --check, eslint ., jest, and tsc. The ESLint step in particular exercises the upgraded package directly.

No mitigating changes were needed.