From e803833cddd6c6ba6f4f7f61ede0a1618b03f8ea Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 14 Nov 2026 13:29:10 +0000 Subject: [PATCH 1/2] CI: actions on the Node 24 runtime; Node 22 or later Every CI and publish run now ends with a runner warning: "Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4, actions/upload-artifact@v4." The v4 majors declare `runs.using: node20`; the current majors (checkout v5+, setup-node v5+, upload-artifact v6+) declare node24, and all three are at v7. Both workflows move to v7. What changed between the majors crossed, checked against each action's action.yml and release notes: - checkout: inputs identical; v7 refuses a fork checkout under pull_request_target/workflow_run unless allow-unsafe-pr-checkout is set. CI runs on pull_request, so nothing changes. - setup-node: `cache: npm` is unchanged. v5 added automatic caching when package.json names a packageManager (it does not here); v7 no longer exports a dummy NODE_AUTH_TOKEN. npm 11.19 `npm ci` with the action's .npmrc and no NODE_AUTH_TOKEN was tested and works, and the stage step sets the variable itself as before, so trusted publishing is unaffected. publish.yml now sets package-manager-cache: false, as the action's trusted-publishing guide asks. - upload-artifact: v5 only bumped @actions/artifact, v6 moved to node24, v7 added an `archive` input that defaults to true. name/path are the same; the artifact is a zip as before. All three need runner 2.327.1 or later; the hosted runners are on 2.338.2. Node 24 has shipped npm 11.16 or later since 24.18.0, so `npm stage`'s floor (11.15) is met by setup-node alone; the explicit npm install stays as a guard against a lagging toolcache. Node floor: engines.node is now >=22 (was >=18). Node 18 reached end of life in April 2025 and Node 20 in April 2026. The matrix tests the maintained LTS lines, 22, 24 and 26, instead of 20, 22, 24. CHANGELOG records it as a breaking change for the next alpha. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_016NSWj8b7T4dcswUnPdzYuv --- .github/workflows/ci.yml | 11 +++++++---- .github/workflows/publish.yml | 11 ++++++++--- CHANGELOG.md | 10 ++++++++++ README.md | 2 +- package.json | 2 +- 5 files changed, 27 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d35f62c..dfd2520 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,15 +15,18 @@ jobs: fail-fast: false matrix: os: [ubuntu-latest] - node: [20, 22, 24] + # The Node lines the package supports (engines.node >=22): every + # LTS line still maintained by Node.js. Drop a line when it reaches + # end of life and raise engines.node in the same change. + node: [22, 24, 26] # Windows too: tools that read paths as globs (tsup's entries) break # on backslashes, and people develop the SDK there. include: - os: windows-latest node: 24 steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: ${{ matrix.node }} cache: npm @@ -33,7 +36,7 @@ jobs: - name: Pack if: matrix.node == 24 && matrix.os == 'ubuntu-latest' run: npm pack - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@v7 if: matrix.node == 24 && matrix.os == 'ubuntu-latest' with: name: versionone-agility-sdk-tarball diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 05bfb0b..4eeff72 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -41,12 +41,17 @@ jobs: # only a run in this environment can publish. environment: npm steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v7 with: node-version: 24 registry-url: https://registry.npmjs.org - # `npm stage` needs npm 11.15.0 or later. + # Never restore a dependency cache in the job that holds the OIDC + # token (setup-node's own advice for trusted publishing). + package-manager-cache: false + # `npm stage` needs npm 11.15.0 or later. Node 24 has shipped npm 11.16+ + # since 24.18.0 (June 2026); this keeps the floor if the runner's + # toolcache lags. - run: npm install -g npm@^11.15.0 - run: npm ci - name: The tag names the version in package.json diff --git a/CHANGELOG.md b/CHANGELOG.md index b8cc5c5..eb2b0ab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## 1.0.0-alpha.6 (unreleased) + +### Breaking + +- **Node 22 or later** (`engines.node` is `>=22`, was `>=18`). Node 18 + reached end of life in April 2025 and Node 20 in April 2026; neither + gets security fixes. CI tests the maintained LTS lines, 22, 24 and 26, + so a consumer on 18 or 20 was already untested. (The slack bot runs 24 + and gh-v1 requires 22; agility-rooms runs in the browser.) + ## 1.0.0-alpha.5 (unreleased) ### Added diff --git a/README.md b/README.md index 2b32750..c1e4eff 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # @versionone/agility-sdk -TypeScript SDK for the Digital.ai Agility (formerly VersionOne) API. It works in Node (ESM or CommonJS) and the browser, ships its own types, and has no runtime dependencies. +TypeScript SDK for the Digital.ai Agility (formerly VersionOne) API. It works in Node 22 or later (ESM or CommonJS) and the browser, ships its own types, and has no runtime dependencies. Not to be confused with `v1sdk`, the 2.x JavaScript SDK: this is a new API, not a compatible successor. diff --git a/package.json b/package.json index eacd2f0..29331e6 100644 --- a/package.json +++ b/package.json @@ -33,7 +33,7 @@ "CHANGELOG.md" ], "engines": { - "node": ">=18" + "node": ">=22" }, "scripts": { "build": "tsup", From 202bbd2ae0bec45935994e196a53950e8fddae2d Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 14 Nov 2026 13:31:27 +0000 Subject: [PATCH 2/2] Build for Node 22; alpha.5 is released tsup's target follows engines.node (node22, was node18), so the emitted syntax floor matches the claim; CHANGELOG's breaking line says so. 1.0.0-alpha.5 was published and tagged latest on 2026-11-14, so its heading loses "(unreleased)". Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_016NSWj8b7T4dcswUnPdzYuv --- CHANGELOG.md | 5 +++-- tsup.config.ts | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eb2b0ab..a106616 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,13 +4,14 @@ ### Breaking -- **Node 22 or later** (`engines.node` is `>=22`, was `>=18`). Node 18 +- **Node 22 or later** (`engines.node` is `>=22`, was `>=18`), and `dist` + is now built for Node 22+ (tsup's `target` was `node18`). Node 18 reached end of life in April 2025 and Node 20 in April 2026; neither gets security fixes. CI tests the maintained LTS lines, 22, 24 and 26, so a consumer on 18 or 20 was already untested. (The slack bot runs 24 and gh-v1 requires 22; agility-rooms runs in the browser.) -## 1.0.0-alpha.5 (unreleased) +## 1.0.0-alpha.5 ### Added diff --git a/tsup.config.ts b/tsup.config.ts index 0fb8c72..23d2913 100644 --- a/tsup.config.ts +++ b/tsup.config.ts @@ -6,5 +6,5 @@ export default defineConfig({ dts: true, sourcemap: true, clean: true, - target: "node18" + target: "node22" }); \ No newline at end of file