Require Node with the eMudhra CA fix

.github/workflows/ci.yml

@@ -8,10 +8,18 @@ on:
 
 jobs:
   build:
+    # Named by major so required status checks survive version bumps.
+    name: build (${{ matrix.major }})
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: [20, 22]
+        # Exact releases with the eMudhra CA fix: setup-node's manifest lags
+        # them, so "22" and "24" still resolve to unpatched builds.
+        include:
+          - major: 22
+            node-version: 22.23.4
+          - major: 24
+            node-version: 24.22.1
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/publish.yml

@@ -17,7 +17,9 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v6
         with:
-          node-version: 24
+          # Exact release with the eMudhra CA fix: setup-node's manifest lags
+          # it, so "24" still resolves to an unpatched build.
+          node-version: 24.22.1
           registry-url: "https://registry.npmjs.org"
 
       - name: Install dependencies

CHANGELOG.md

@@ -25,6 +25,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   on chat and email; phone takes `to_phone_number` and `from_phone_number`
   instead.
 
+### Changed
+
+- **Breaking**: requires Node.js 22 or newer (`engines` was `>=20`). Node.js 20
+  has no fix for the eMudhra certificate authority compromise below.
+
+### Security
+
+- The client uses Node's built-in `fetch`, which trusts the CA list bundled with
+  your Node.js release. Node.js releases before 22.23.4, 24.22.1 and 26.12.1
+  still trust the compromised eMudhra intermediate certificate authorities
+  disclosed in October 2026, which would let an attacker impersonate the
+  Gradient Labs API. Run Node.js 22.23.4, 24.22.1, 26.12.1 or later.
+
+## [0.1.2]
+
+### Added
+
+- `client.conversations.delete()` and `client.backOfficeTasks.delete()`.
+- `reason_code` on finishing a conversation.
+- `customer_support_platform_identifiers` on starting a conversation.
+
 ## [Unreleased]
 
 ### Added

README.md

@@ -4,7 +4,13 @@ Official client for the [Gradient Labs API](https://api.gradient-labs.ai). Writt
 in TypeScript, ships full type declarations and both ESM and CommonJS builds, and
 has **zero runtime dependencies** (it uses Node's built-in `fetch` and `crypto`).
 
-Requires **Node.js 20** or newer.
+Requires **Node.js 22** or newer.
+
+The client uses Node's built-in `fetch`, which verifies TLS certificates against
+the CA list bundled with your Node.js release. Releases before **22.23.4**,
+**24.22.1** and **26.12.1** still trust the compromised eMudhra intermediate
+certificate authorities disclosed in October 2026, so run one of those versions
+or later. Node.js 20 and earlier have no fix.
 
 ## Installation
 

package.json

@@ -4,7 +4,7 @@
   "description": "Official Node.js / TypeScript client for the Gradient Labs API",
   "type": "module",
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "exports": {
     ".": {