Bump protobufjs to ^8.4.0 to drop @types/node and 10 other transitive packages

[ScottMansfield]

Summary

@google/genai pins protobufjs: ^7.5.4, which can never resolve to a version where
@types/node and the nine @protobufjs/* sub-packages have been removed. Bumping to
^8.4.0 drops 11 transitive packages and ~2 MB from every install, with no source
changes required.

Background

protobufjs moved @types/node out of production dependencies and inlined the
@protobufjs/* helpers. Dependency sets:

protobufjs	dependencies
7.5.4, 7.6.5, 8.0.0	long, @types/node, + 9 × @protobufjs/*
8.4.0+ (latest 8.7.2)	long

Measured on a clean install:

protobufjs@7.6.5 :   5.66 MB, 13 pkgs
protobufjs@8.7.2 :   3.67 MB,  2 pkgs
DELTA            :   1.99 MB, 11 pkgs

@types/node as a production dependency was a long-standing complaint on protobufjs
(protobufjs/protobuf.js#1026, #1558, #2019, #2030) — not only for the ~2.7 MB, but because
it leaks Node globals into web builds and changes inferred types like setTimeout's return.
It was resolved upstream; @google/genai just can't reach the fix through ^7.

Compatibility

protobufjs is used in exactly one place — ModelProto.decode() in the SentencePiece
tokenizer (src/cross/sentencepiece/_processor.ts:415), via the generated
sentencepiece_model.pb.js which imports protobufjs/minimal.js.

Verified against protobufjs@8.7.2:

• protobufjs/minimal.js still exists and exports Reader as before
• the existing generated sentencepiece_model.pb.js round-trips unchanged:

encode+decode on pbjs@8 OK -> {"piece":"▁hi","score":-1.5,"type":1,"vocab":7,"unk":" ⁇ "}

No regeneration of the .pb.js and no changes to _processor.ts appear to be needed.
rollup.config.mjs already externalizes protobufjs/minimal, so bundling is unaffected.

Suggested change

-    "protobufjs": "^7.5.4",
+    "protobufjs": "^8.4.0",

and correspondingly for protobufjs-cli in devDependencies if a matching major is
required for generate-proto.

Note for downstream

Consumers whose tree also contains protobufjs 7 via other paths (@grpc/proto-loader,
@opentelemetry/otlp-transformer) will end up with both majors installed until those move
too. That is a net wash for them, but a clear win for anyone installing @google/genai
on its own.

Related

protobufjs is only reachable through the @google/genai/tokenizer entry point — it
contributes 0 bytes to the main bundle. Making it an optionalDependency (or optional peer)
would remove the remaining ~3.7 MB for the majority of users who never import the tokenizer.
Happy to open that as a separate issue if it's of interest.

[Varun-S10]

Hi @ScottMansfield, Thank you for your feedback. We appreciate you taking the time to share your thoughts with us, and we will be filing a feature request.