Repository navigation
Require Node with the eMudhra CA fix - #16
Merged
Merged
Conversation
Node releases before 22.23.4, 24.22.1 and 26.12.1 trust the compromised eMudhra intermediate CAs, and Node 20 has no fix. Require Node 22+, document the fixed versions, and pin CI and publish to fixed releases (setup-node's manifest still resolves "22"/"24" to unpatched builds). Also add the missing 0.1.2 changelog entries ahead of releasing 0.1.3.
Required status checks match job names, so naming jobs by the exact pinned release would break them on every version bump.
djeer
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of PLA-173 (eMudhra intermediate CA compromise).
The client uses Node's built-in
fetch, so it trusts the CA list bundled with the customer's Node release. Node releases before 22.23.4, 24.22.1 and 26.12.1 still trust the compromised eMudhra intermediates, which would let an attacker impersonateapi.gradient-labs.aiand capture API keys. Node 20 has no fix.What
engines.node:>=20→>=22(lockfile root synced; no dependency changes).0.1.3: a breaking Changed entry for the Node 22 requirement and a Security entry with the fixed versions. Also adds the missing0.1.2entries (conversations.delete(),backOfficeTasks.delete(),reason_code,customer_support_platform_identifiers).[20, 22]→[22.23.4, 24.22.1]. Publish:24→24.22.1. These are pinned because setup-node'sactions/node-versionsmanifest doesn't list the fixed releases yet, so22/24still resolve to unpatched builds. Exact versions missing from the manifest are downloaded from nodejs.org.Release
npm has
0.1.1;package.jsonis already0.1.3, with the unreleased outbound-conversation breaking change (which mirrorsPOST /outbound/conversationsalready being removed from the API). The plan is to publish0.1.3once this merges, by taggingv0.1.3on main, which runspublish.yml.Testing
On Node 24.22.1:
npm ci, lint, format check, typecheck, build and tests pass. CI covers 22.23.4.