CI: actions on the Node 24 runtime; Node 22 or later

.github/workflows/ci.yml

@@ -15,15 +15,18 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        node: [20, 22, 24]
+        # The Node lines the package supports (engines.node >=22): every
+        # LTS line still maintained by Node.js. Drop a line when it reaches
+        # end of life and raise engines.node in the same change.
+        node: [22, 24, 26]
         # Windows too: tools that read paths as globs (tsup's entries) break
         # on backslashes, and people develop the SDK there.
         include:
           - os: windows-latest
             node: 24
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -33,7 +36,7 @@ jobs:
       - name: Pack
         if: matrix.node == 24 && matrix.os == 'ubuntu-latest'
         run: npm pack
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         if: matrix.node == 24 && matrix.os == 'ubuntu-latest'
         with:
           name: versionone-agility-sdk-tarball

.github/workflows/publish.yml

@@ -41,12 +41,17 @@ jobs:
     # only a run in this environment can publish.
     environment: npm
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
-      # `npm stage` needs npm 11.15.0 or later.
+          # Never restore a dependency cache in the job that holds the OIDC
+          # token (setup-node's own advice for trusted publishing).
+          package-manager-cache: false
+      # `npm stage` needs npm 11.15.0 or later. Node 24 has shipped npm 11.16+
+      # since 24.18.0 (June 2026); this keeps the floor if the runner's
+      # toolcache lags.
       - run: npm install -g npm@^11.15.0
       - run: npm ci
       - name: The tag names the version in package.json

CHANGELOG.md

@@ -1,6 +1,17 @@
 # Changelog
 
-## 1.0.0-alpha.5 (unreleased)
+## 1.0.0-alpha.6 (unreleased)
+
+### Breaking
+
+- **Node 22 or later** (`engines.node` is `>=22`, was `>=18`), and `dist`
+  is now built for Node 22+ (tsup's `target` was `node18`). Node 18
+  reached end of life in April 2025 and Node 20 in April 2026; neither
+  gets security fixes. CI tests the maintained LTS lines, 22, 24 and 26,
+  so a consumer on 18 or 20 was already untested. (The slack bot runs 24
+  and gh-v1 requires 22; agility-rooms runs in the browser.)
+
+## 1.0.0-alpha.5
 
 ### Added
 

README.md

@@ -1,6 +1,6 @@
 # @versionone/agility-sdk
 
-TypeScript SDK for the Digital.ai Agility (formerly VersionOne) API. It works in Node (ESM or CommonJS) and the browser, ships its own types, and has no runtime dependencies.
+TypeScript SDK for the Digital.ai Agility (formerly VersionOne) API. It works in Node 22 or later (ESM or CommonJS) and the browser, ships its own types, and has no runtime dependencies.
 
 Not to be confused with `v1sdk`, the 2.x JavaScript SDK: this is a new API, not a compatible successor.
 

package.json

@@ -33,7 +33,7 @@
     "CHANGELOG.md"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "scripts": {
     "build": "tsup",

tsup.config.ts

@@ -6,5 +6,5 @@ export default defineConfig({
   dts: true,
   sourcemap: true,
   clean: true,
-  target: "node18"
+  target: "node22"
 });