chore(deps): refresh the five in-range dependencies (lockfile only)

[nzneit]

Refreshes the five dependencies whose newest release already satisfies the declared range, as a lockfile-only change with package.json untouched. Records the review of all nine outdated packages as D-021.

package
@asyncapi/parser	3.6.0 → 3.6.1
hono	4.12.27 → 4.12.33
mqtt	5.15.1 → 5.15.2	dev
@types/react	19.2.17 → 19.2.18	dev
@types/react-dom	19.2.3 → 19.2.4	dev

A version bump and a range change are different acts. The first says "take the newest build of what we already declared"; the second says "we now require something we previously did not". Only the first is routine, so only the first is bundled here.

bun update does not respect that line: it rewrote seven package.json floors as a side effect, including for ajv, yaml, react, react-dom, typescript and biome, none of which changed version at all. Those floors are declared intent, so they were restored and the lockfile refresh kept on its own.

Gates

check-docs, lint, typecheck, demo-app:build and full bun test each exit 0, against a same-command baseline taken on main beforehand. @asyncapi/parser 3.6.1 adds a v3 channel-parameter-vs-address-placeholder validation rule, the one item here that could have rejected a previously-accepted fixture. It does not.

The four not taken

Each needs a range change, and each is decided on evidence rather than swept in.

mqtt-pattern 2.1.1 — declined. Its runtime is byte-identical to 1.2.0: index.js in the two tarballs has the same sha256 (63fbbfd2…) once CRLF/LF is normalized. The entire major is .d.ts files plus a ts-toolbelt production dependency. And the types are strictly worse for this codebase's call shape: exec becomes exec<P extends string>(p: P, t: string): MqttParameters<P> | null, but offbook computes patterns at runtime via toPattern(c.topic), so P infers as the general string and MqttParameters<string> resolves to a type with no properties:

TS7053: Property 'deviceId' does not exist on type 'MqttParameters<string>'

The repo typechecks under v2 only because the 9-line ambient shim in src/registry/mqtt-pattern.d.ts shadows the shipped types, or because the existing as Record<string, string> cast absorbs them. Deleting that shim is the only thing the bump could buy, and the shim is the more accurate declaration. Both paths verified.

aedes 1.1.1 — deferred behind R-006/R-007. 1.x is "type": "module", engines.node >= 20, exports class Aedes as a named export, and sets its default export to a function whose entire body throws:

Aedes default export has been removed.
Use 'const aedes = await Aedes.createBroker()' instead.

src/broker/index.ts does import Aedes from "aedes" and new Aedes({...}), so it hits that throw. The constructor also becomes static async createBroker(opts) and drainTimeout changes default from 0 to 60000. The deciding reason to defer rather than migrate: R-006 (WS fidelity) and R-007 (capture the browser application's connect()) both measure broker/'s current Aedes defaults and the ws stack underneath them, so moving that floor first would invalidate the thing being measured. aedes-server-factory is not a maintained path to 1.x either, having last published 2021-06-28, nearly three years before aedes 1.0.

@biomejs/biome 2.5.6 and typescript 7.0.2 — both viable, both deferred to their own PRs. TypeScript 7 is #5, stacked on this one.

⚠️ biome migrate is not safe to run unattended here

Worth reading even if you skip the rest. Pointed at this repo's v1 config it rewrites

"rules": { "recommended": true }   →   "rules": { "preset": "none" }

which does not preserve the rule set, it removes it. Verified by measurement rather than by reading the output: a file containing any, == and an unused var draws zero diagnostics under the migrated config, and four (noExplicitAny ×2, noDoubleEquals, noUnusedVariables) once preset is corrected to "recommended".

The failure mode is the dangerous kind: biome check . exits 0, CI stays green, and the lint gate is gone. This is now recorded in the AGENTS.md working notes alongside the other gate hazards.

For whoever takes the biome 2 PR: with the config corrected by hand it is 17 assist/source/organizeImports (named-import sorting, auto-fixable churn from v2's import-organizer overhaul), 14 lint/correctness/noUnsafeOptionalChaining, and 4 assorted. The transport-isolation rule survives the move out of nursery into style and was re-verified to still error outside src/broker/ and stay exempt inside it. The 14 correctness findings are real but low-severity and confined to test files, all the same (x[0]?.payload as T).prop shape: a ?. guard immediately dereferenced, so a genuine failure surfaces as a confusing TypeError instead of a clean assertion diff.