feat: trim dependencies, drop Node 16, and target ES2020

[oliverlaz]

Removes 19 unused or redundant packages, drops Node 16, and retargets the build from IE 10 to an ES2020 baseline.

	Before	After
dependencies	9	6
devDependencies	50	34
yarn.lock entries	1266	850 (−33%)
dist min+gzip	42,771 B	38,831 B (−9%)

Removed

• puppeteer, puppeteer-core — these only supplied a Chrome binary that the CI runner already provides. karma-chrome-launcher resolves google-chrome from PATH, and the puppeteer-installed binary was never wired up via CHROME_BIN, so the Install Chrome step was a no-op. The PUPPETEER_SKIP_DOWNLOAD env in size.yml and the skip-puppeteer action input go with them.
• request (deprecated since 2020) — replaced with axios, which is already a dependency, across 7 test call sites. The callback-style tests became zero-arg async functions, which also means they now get wrapFn's failure-tracking and skip handling.
• qs, @types/qs — replaced with native URLSearchParams at the single call site, src/redirect_url.ts. @types/qs had zero references in the published .d.ts.
• @babel/runtime, @babel/plugin-transform-runtime — helpers are inlined instead. This is the only removal that touches runtime dependencies: consumers stop installing 1.1 MB / 245 files, and the gzipped bundle is actually 75 bytes smaller.
• @babel/plugin-proposal-class-properties, @babel/plugin-proposal-object-rest-spread, @babel/plugin-transform-object-assign — redundant under preset-env.
• @babel/node, json-loader, nyc, karma-sauce-launcher — unreferenced anywhere in the repo.
• husky, @commitlint/cli, @commitlint/config-conventional — dead configuration. The husky.hooks block was v4 syntax that v8 ignores, there was no .husky/ directory, no husky install in prepare, and no commitlint config or workflow invoking either. The pre-commit hook had not been running; CI still enforces lint via lint.yml.
• eslint-plugin-sonarjs, and @babel/register (unneeded once Node 16 is gone).

Node 16 dropped

Node 16 reached end of life on 2023-09-11. babel-register.js (a bespoke @babel/register shim with a custom import.meta plugin) and the unit-node16 CI job are gone, engines.node moves to >=18, and the README is updated. test-unit-node is now the only unit-test entry point, so CI runs exactly what you run locally — previously the Babel path could drift from the tsx path silently.

ES2020 target

Worth knowing: removing ie >= 10 on its own changes nothing, because last 2 versions still pulls in op_mini all, bb 7, ie_mob and kaios 2.5, which force full ES5 by themselves. A real floor was needed. last 2 versions, not dead was measured too, but it covers only 65.9% of users — it means the two newest releases of each browser. The ES2020 minimums land at 91.3% coverage for ~5 KB more than that aggressive option.

Verification

yarn install --immutable, lint, build, types, test-types and dist all pass. Unit tests: 145 passing. The one local failure is should follow redirect urls, which makes a real HTTP call and 401s without valid credentials — it fails identically before and after this change.

The qs → URLSearchParams swap changes a URL that the analytics endpoint parses, so it was done with a characterization test written first: should encode the query string exactly passes unchanged against both the old and new implementations. It pins spaces as %20 (never +) and ~ as literal (never %7E) — the two places where URLSearchParams and qs.stringify diverge, which is what the two .replace() calls in redirect_url.ts are for. Please don't remove them.

The @babel/plugin-proposal-* removals were verified by compiling all 17 src files with and without them and diffing: byte-identical. All 17 files in the built lib/ parse as ES2020 with no ES2021+ syntax.

Two things can only be checked in CI: the cloud integration tests exercising the axios rewrites, and test-browser.

Please look at these

1. .yarnrc.yml flips enableHardenedMode: true → false. This is the one line here that is security-relevant rather than cleanup — hardened mode is what makes Yarn verify lockfile integrity against the registry in CI. Included deliberately; happy to split it out.
2. Semver. Tagged feat: for a minor release as intended, but note that dropping Node 16 and moving the browser floor to Chrome 80 / Safari 13.1 are breaking for anyone on those runtimes. Release notes should call out all three consumer-visible changes: the Node floor, the browser floor, and @babel/runtime no longer being installed.
3. A test was passing for the wrong reason. files.js fetched http://nodejs.org/images/logo.png, which now returns 404. It passed anyway because form-data derived the filename from request's internals rather than the response, so it was uploading an HTML error page and asserting on the name. Now points at a live URL with an explicit filename.

Also fixed

karma.config.js replaced the base webpack plugins instead of extending them, dropping the DefinePlugin that defines process.env.PACKAGE_VERSION. Combined with EnvironmentPlugin only substituting env keys that are actually set, this left bare process.env references in the bundle and produced process is not defined whenever credentials were absent. It now extends the base plugins and supplies defaults for the five variables the bundle reads, so a credential-less run fails with the tests' own error message instead.

[github-actions]

Size Change: +17.5 kB (+16.01%) ⚠️

Total Size: 127 kB

📦 View Changed

Filename	Size	Change
dist/js_min/getstream.js	38.8 kB	+3.29 kB (+9.26%)	🔍
dist/js/getstream.js	88.2 kB	+14.2 kB (+19.26%)	⚠️

_{compressed-size-action}