Refresh repo dependencies

Why:
Dependabot had narrow dependency PRs while the repo had broader transitive refresh work available. This consolidates the feasible dependency refresh into one tested release.

What:
- Refresh repo dependencies and lockfile resolutions.
- Remove obsolete test-only temp helper dependency in favor of native Node temporary-directory APIs.
- Add a Changesets release note for @transloadit/node, transloadit, and @transloadit/mcp-server.
- Document held-back got and zod upgrades for separate migration work.

Author: kvz

.changeset/deps-refresh.md

@@ -0,0 +1,13 @@
+---
+"@transloadit/mcp-server": patch
+"@transloadit/node": patch
+"transloadit": patch
+---
+
+Refresh repository dependencies for the Node SDK, the legacy `transloadit` wrapper, and the
+validated MCP server release line.
+
+This release folds in broad tooling and package updates, security and transitive lockfile refreshes,
+and the test-only replacement of the obsolete `temp` helper with native Node temporary-file APIs.
+`got` and `zod` remain on their current major versions because their latest releases require
+follow-up migration work.

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.14/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.4.15/schema.json",
   "vcs": { "enabled": true, "clientKind": "git", "useIgnoreFile": true },
   "files": {
     "ignoreUnknown": false,

package.json

@@ -36,14 +36,14 @@
     "tsc:zod": "yarn workspace @transloadit/zod sync && node ./node_modules/typescript/bin/tsc -b packages/zod/tsconfig.build.json"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.14",
+    "@biomejs/biome": "^2.4.15",
     "@changesets/cli": "^2.31.0",
-    "@types/node": "^25.6.0",
-    "@vitest/coverage-v8": "^4.1.5",
-    "jest-diff": "^30.3.0",
-    "knip": "^6.12.0",
+    "@types/node": "^25.8.0",
+    "@vitest/coverage-v8": "^4.1.6",
+    "jest-diff": "^30.4.1",
+    "knip": "^6.14.1",
     "npm-run-all": "^4.1.5",
     "typescript": "6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.6"
   }
 }

packages/mcp-server/package.json

@@ -70,7 +70,7 @@
   },
   "devDependencies": {
     "@types/express": "^5.0.6",
-    "@types/node": "^25.6.0"
+    "@types/node": "^25.8.0"
   },
   "mcpName": "io.github.transloadit/mcp-server"
 }

packages/node/package.json

@@ -46,7 +46,7 @@
     "lodash-es": "^4.18.1",
     "node-watch": "^0.7.4",
     "p-map": "^7.0.4",
-    "p-queue": "^9.2.0",
+    "p-queue": "^9.3.0",
     "recursive-readdir": "^2.2.3",
     "tus-js-client": "^4.3.1",
     "typanion": "^3.14.0",
@@ -56,16 +56,14 @@
   "devDependencies": {
     "@types/debug": "^4.1.13",
     "@types/lodash-es": "^4.17.12",
-    "@types/node": "^25.6.0",
+    "@types/node": "^25.8.0",
     "@types/recursive-readdir": "^2.2.4",
-    "@types/temp": "^0.9.4",
     "badge-maker": "^5.0.2",
     "execa": "9.6.1",
     "image-size": "^2.0.2",
-    "nock": "^14.0.14",
+    "nock": "^14.0.15",
     "p-retry": "^8.0.0",
-    "rimraf": "^6.1.3",
-    "temp": "^0.9.4"
+    "rimraf": "^6.1.3"
   },
   "repository": {
     "type": "git",

packages/node/test/e2e/live-api.test.ts

@@ -1,14 +1,15 @@
 import { randomUUID } from 'node:crypto'
 import { createWriteStream, existsSync } from 'node:fs'
+import { mkdtemp } from 'node:fs/promises'
 import type { IncomingMessage, RequestListener } from 'node:http'
+import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { parse } from 'node:querystring'
 import { pipeline } from 'node:stream/promises'
 import { setTimeout } from 'node:timers/promises'
 import debug from 'debug'
 import got, { type RetryOptions } from 'got'
 import intoStream from 'into-stream'
-import * as temp from 'temp'
 import { describe } from 'vitest'
 import type { InterpolatableRobotFileFilterInstructionsInput } from '../../src/alphalib/types/robots/file-filter.ts'
 import type { InterpolatableRobotImageResizeInstructionsInput } from '../../src/alphalib/types/robots/image-resize.ts'
@@ -35,7 +36,8 @@ function nn<T>(value: T | null | undefined, name = 'value'): T {
 }
 
 async function downloadTmpFile(url: string) {
-  const { path } = await temp.open('transloadit')
+  const dir = await mkdtemp(join(tmpdir(), 'transloadit-'))
+  const path = join(dir, 'download')
   await pipeline(got.stream(url), createWriteStream(path))
   return path
 }
@@ -230,7 +232,7 @@ describeLive('API integration', { timeout: 60000, retry: 1 }, () => {
           },
         },
         files: {
-          original: temp.path({ suffix: '.transloadit.jpg' }), // Non-existing path
+          original: join(tmpdir(), `${randomUUID()}.transloadit.jpg`), // Non-existing path
         },
       })
       await expect(promise).rejects.toThrow()

packages/node/test/e2e/resume-assembly.test.ts

@@ -1,10 +1,10 @@
 import { randomUUID } from 'node:crypto'
 import { once } from 'node:events'
-import { writeFile } from 'node:fs/promises'
+import { mkdtemp, writeFile } from 'node:fs/promises'
 import type { IncomingMessage } from 'node:http'
 import { createServer } from 'node:http'
-import { basename } from 'node:path'
-import temp from 'temp'
+import { tmpdir } from 'node:os'
+import { basename, join } from 'node:path'
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 import { Transloadit } from '../../src/Transloadit.ts'
 
@@ -39,7 +39,8 @@ async function readBody(req: IncomingMessage): Promise<Buffer> {
 }
 
 async function createTmpFile(contents: string): Promise<string> {
-  const { path } = await temp.open('transloadit-resume')
+  const dir = await mkdtemp(join(tmpdir(), 'transloadit-resume-'))
+  const path = join(dir, 'upload.txt')
   await writeFile(path, contents, 'utf8')
   return path
 }

packages/node/test/unit/resume-assembly.test.ts

@@ -1,8 +1,8 @@
 import { createReadStream } from 'node:fs'
-import { writeFile } from 'node:fs/promises'
+import { mkdtemp, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { Readable } from 'node:stream'
-import temp from 'temp'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import type { AssemblyStatus } from '../../src/alphalib/types/assemblyStatus.ts'
 import { Transloadit } from '../../src/Transloadit.ts'
@@ -161,7 +161,7 @@ describe('resumeAssemblyUploads', () => {
       endpoint: 'http://example.com',
     })
 
-    const dir = await temp.mkdir('resume-finished')
+    const dir = await mkdtemp(join(tmpdir(), 'resume-finished-'))
     const filePath = join(dir, 'done.txt')
     await writeFile(filePath, 'done', 'utf8')
 
@@ -216,7 +216,7 @@ describe('resumeAssemblyUploads', () => {
       endpoint: 'http://example.com',
     })
 
-    const dir = await temp.mkdir('resume-collision')
+    const dir = await mkdtemp(join(tmpdir(), 'resume-collision-'))
     const fileAPath = join(dir, 'b::1')
     const fileBPath = join(dir, '1')
 

packages/notify-url-relay/package.json

@@ -43,7 +43,7 @@
     "p-retry": "^8.0.0"
   },
   "devDependencies": {
-    "@types/node": "^25.6.0",
+    "@types/node": "^25.8.0",
     "transloadit": "^4.10.1"
   }
 }

packages/transloadit/package.json

@@ -46,7 +46,7 @@
     "lodash-es": "^4.18.1",
     "node-watch": "^0.7.4",
     "p-map": "^7.0.4",
-    "p-queue": "^9.2.0",
+    "p-queue": "^9.3.0",
     "recursive-readdir": "^2.2.3",
     "tus-js-client": "^4.3.1",
     "typanion": "^3.14.0",
@@ -55,7 +55,7 @@
   },
   "devDependencies": {
     "@types/debug": "^4.1.13",
-    "@types/node": "^25.6.0",
+    "@types/node": "^25.8.0",
     "@types/recursive-readdir": "^2.2.4"
   },
   "repository": {