[czerwiukk]

Description

What's bumped

Example runtime deps (room-manager)

• axios ^1.7.9 → ^1.15.0 (Bump axios from 1.7.9 to 1.15.0 #258, Bump axios from 1.7.9 to 1.13.0 #211)
• fastify ^5.2.1 → ^5.7.3 (Bump fastify from 5.2.1 to 5.7.3 #227, Bump fastify from 5.2.1 to 5.6.1 #201)
• @fastify/cors ^10.1.0 → ^11.1.0 (Bump @fastify/cors from 10.1.0 to 11.1.0 #181)
• fluent-json-schema ^5.0.0 → ^6.0.0 (Bump fluent-json-schema from 5.0.0 to 6.0.0 #143)

Lockfile-only (transitive)

• source-map-js (Bump source-map-js from 1.2.1 to 1.2.2 #306), vite (Bump vite from 7.1.9 to 7.3.2 #255), picomatch (Bump picomatch from 2.3.1 to 2.3.2 #251), flatted (Bump flatted from 3.3.1 to 3.4.2 #249), elysia (Bump elysia from 1.3.8 to 1.4.27 #241), minimatch (Bump minimatch from 3.1.2 to 3.1.5 #236), rollup (Bump rollup from 4.38.0 to 4.59.0 #235), jws (Bump jws from 4.0.0 to 4.0.1 #215), form-data (Bump form-data from 4.0.0 to 4.0.4 #172)

Dev tooling (#237)

• eslint 10, @eslint/js 10, globals 17, typescript-eslint 8.57+
• prettier, cspell, lint-staged, typedoc, typedoc-material-theme, tsup 8.5, ts-proto, @openapitools/openapi-generator-cli, @fastify/swagger, pino-pretty, tsx, bun-types (+ @types/bun to match)
• typescript ^5.9.3

Not included from #237

• TypeScript 6: moduleResolution: "node" is deprecated and now a hard error (TS5107) in fishjam-openapi, fishjam-proto and composition-openapi. This needs a tsconfig migration, which belongs in a separate PR.
• @types/node 25: the SDK supports Node >= 18 (and room-manager's image runs Node 22), so Node 25 typings would allow APIs those runtimes don't have. Kept on ^22.

Code changes the bumps required

• examples/room-manager/src/index.ts: pass ignoreTrailingSlash via routerOptions. The top-level option raises FSTDEP022 on newer fastify 5.x.
• packages/composition/src/eventBus.ts: removed an eslint-disable no-var that eslint 10 reports as unused.
• packages/js-server-sdk/package.json: set tsup removeNodeProtocol: false. tsup 8.5 strips node: from ESM imports too (8.4 only did it for CJS). With this option the ESM bundle keeps node:crypto / node:fs/promises as before, and CJS now uses them as well (fine on Node >= 18).
• examples/{multimodal,transcription,selective-subscription/backend}: declare @sinclair/typebox. elysia 1.4 no longer installs it, so these examples crashed at startup with Cannot find module '@sinclair/typebox'.
• examples/selective-subscription/backend/src/controllers/notifications.ts: return the SSE stream as a plain Response. elysia 1.4 appended text/plain to the Content-Type set through set.headers, which made the frontend's EventSource reject the stream.

Verification

Compared against a clean build of main:

• yarn install --immutable, format:check, build, lint:check, docs, spellcheck: pass
• tsc run directly in all 12 workspaces: 0 errors
• eslint 10 run directly in each linted workspace: 0 problems
• Unit tests: composition 29/29, composition-cli 31/31, js-server-sdk 102/102 (live-backend client.test.ts excluded locally; runs in CI)
• selective-subscription-frontend and room-manager builds pass
• room-manager booted against a stub backend: /health, CORS, preflight, query validation (400 on missing peerName), trailing-slash routing and 404 all match main; no deprecation warnings
• Published packages: yarn pack file lists match main for js-server-sdk, composition and composition-cli. Type declarations differ only in import order. JS differences in js-server-sdk:
  • newer bundled @bufbuild/protobuf 2.x (pulled in by ts-proto)
  • explicit class-field declarations for constructor parameter properties in the generated OpenAPI runtime; resulting objects are the same
• Agent wire protocol: built the generated AgentRequest/AgentResponse/ServerMessage code against @bufbuild/protobuf 2.0.0 (main) and 2.16.0 (this branch). All 307 checks pass: encoded bytes are identical, each version decodes the other's output (audio frames 0 B–1 MB, images up to 2 MB, all 33 server notification types), unknown fields are skipped the same way, invalid UTF-8 is handled the same way, and finish() returns an exact-size copy. Audio frame encoding is ~30% faster.
• Agent examples (multimodal, transcription, selective-subscription backend) under bun with a fake Fishjam service: routes, query validation, CORS and the SSE notification stream match main. The SSE Content-Type is now a single text/event-stream (main sent the value twice).
• yarn npm audit --all --recursive: advisory count 213 → 83

Motivation and Context

Consolidates the open dependabot PRs into a single update on top of current main. All of them conflict with main on yarn.lock, so the bumps were re-applied fresh with yarn up instead of merging the branches.

Supersedes #306, #258, #255, #251, #249, #241, #237, #236, #235, #227, #215, #211, #201, #181, #172, #143. Dependabot should close them automatically once this lands.

Documentation impact

• Documentation update required
• Documentation updated in another PR
• No documentation update required

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to
  not work as expected)