Skip to content

fix(deps): update dependency jose to v6 #426

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
+1,028 −1,635
Open

fix(deps): update dependency jose to v6 #426

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/livekit-server-sdk/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
"@bufbuild/protobuf": "^1.10.1",
"@livekit/protocol": "^1.43.1",
"camelcase-keys": "^9.0.0",
"jose": "^5.1.2"
"jose": "^6.0.0"
Copy link

@devin-ai-integration devin-ai-integration bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Package engines field claims Node.js >=18 but jose v6 drops Node.js 18 support and breaks CJS on Node <22

Updating jose to ^6.0.0 without updating the engines field creates a compatibility mismatch. The package declares "node": ">=18" but jose v6 explicitly drops support for Node.js 18.x and earlier. More critically, jose v6 states: "CJS-style require is now only possible when require(esm) support is present in the Node.js runtime" (require(esm) was added in Node.js 22).

Impact on CJS consumers

The package exports a CJS entry point at packages/livekit-server-sdk/package.json:24 ("default": "./dist/index.cjs"). Since jose is a runtime dependency (not bundled), the CJS build will attempt to require('jose') at runtime. On Node.js versions 18–21, this will fail because jose v6 ships only ESM and those runtimes do not support require(esm). Users on Node.js 18 or 20 (both current LTS lines) who consume livekit-server-sdk via require() will get a runtime error.

The engines field at line 65 should be updated to reflect the actual minimum Node.js version required by the dependency graph (at minimum >=20, or >=22 if CJS support is needed).

Prompt for agents 
Update the engines field in packages/livekit-server-sdk/package.json (currently at line 65: "node": ">=18") to reflect the minimum Node.js version required by jose v6. At minimum, change it to "node": ">=20" (jose v6 drops Node 18 support). If CJS consumers need to be supported, change it to "node": ">=22" since jose v6's CJS-style require only works with Node.js require(esm) support (added in Node 22). Alternatively, consider configuring tsup to bundle jose into the CJS output so CJS consumers on older Node.js versions are not affected.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

},
"devDependencies": {
"@changesets/cli": "^2.27.1",
Expand Down
Loading
Loading