[imdt-claudiop]

What does this PR do?

Two small, independent housekeeping commits on top of v1.x.

1. chore: drop the unbuilt esm entry point and unused dev tooling

Removes packaging and tooling entries that no longer correspond to anything the repository actually does:

• "module": "dist/esm/index.js" in package.json. The build script is rm -rf dist/cjs && tsc --module CommonJS --outDir dist/cjs, so dist/esm is never produced. Bundlers that honour the module field were being pointed at a path that does not exist in the published tarball.
• .npmignore. package.json already declares "files": ["dist"], which takes precedence and governs the published contents, so the file was inert.
• eslint-watch and lint-staged dev dependencies. Neither is referenced by any script or config in the repository (there is no husky or lint-staged configuration).
• "allowJs": true in tsconfig.json. The sources are TypeScript only.
• The self-referencing paths mapping (bigbluebutton-html-plugin-sdk/* -> dist/cjs/*) in tsconfig.json. No source file imports the package by its own name, so the mapping resolved nothing; npx tsc passes identically without it.
• lint:watch invoked yarn lint while the project is npm based. It now calls npm run lint.
• The keywords array carried boilerplate from another package (useAxios, apollo, fetch, mutation, query). Replaced with keywords that describe this package.

No source file and no build output changes: npm run build produces the same dist/cjs before and after.

2. chore(deps): npm audit fix

Brings the SDK audit from 10 vulnerabilities (5 moderate, 5 high) to 0. A plain npm audit fix clears 7 of them but cannot get to 0: advisory GHSA-82fw-gwwq-j7x9 (@vitest/mocker, moderate, dev only) is fixable only across a semver major boundary. vitest and @vitest/coverage-v8 therefore move from ^3.2.6 to ^4.1.11. Note that npm audit fix --force proposed @vitest/coverage-v8@5.0.0, which has a peer conflict with vitest 4, so both packages were aligned at 4.1.11 instead.

Closes Issue(s)

None. This is not tracked by an issue.

Motivation

The packaging metadata advertised an ESM build that the repository does not produce, and carried dev dependencies and config flags that nothing uses. Separately, the dev dependency audit was not clean, and the remaining advisory needed a deliberate major upgrade rather than an automated fix.

More

Validation run locally on this branch, mirroring the four pull_request jobs, with Node.js 20.20.2:

Check	Result
npm ci	passes, 464 packages audited, 0 vulnerabilities
npx tsc	passes
npm run lint	passes
npm run build	passes, emits dist/cjs
npm run test:unit:coverage	passes, 48 of 48 unit tests
npm audit	0 vulnerabilities
./scripts/validate-samples-code.sh	passes, all 23 samples

The 48 unit tests pass identically on vitest 3 before the upgrade and on vitest 4 after it, so the major bump is not changing test behaviour.

Scope and known limitations:

• The 23 sample projects under samples/ are not modified by this PR. They still report between 35 and 41 vulnerabilities each, and clearing them would require --force with major upgrades to copy-webpack-plugin and webpack-dev-server. That remains an open limitation, not something this PR addresses.

• This PR targets v1.x only. The equivalent cleanup on v0.0.x is outside its scope.

• Added/updated documentation

No documentation change applies: the removed keys (module, .npmignore, lint:watch, allowJs) are not referenced in README.md or anywhere else in the repository's Markdown.

[github-actions]

This pull request has conflicts ☹
Please resolve those so we can review the pull request.
Thanks.