kxco-pq-audit 1.5.2 → 1.6.0

package/ASSESSMENT.md

@@ -121,7 +121,7 @@ All checkable without asking us for anything.
 or ten million: a new entry needs the previous hash and the next seq, never the
 log. The throughput table above is the sizing guide.
 
-**Runtime.** Node 20.19 and later, with Node 24 and later running the primitives
+**Runtime.** Node 22.12 and later, with Node 24 and later running the primitives
 in OpenSSL 3.5 for roughly 4x to 8x per operation.
 
 ## Correcting this document

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.6.0 (2026-10-09)
+
+Runtime support. No change to the API or its behaviour.
+
+**Node.js 22.12 or later is required.** `engines.node` moves from `>=20.19`
+to `>=22.12`. Node 20 reached end of life on 30 April 2026. 22.12 is the
+first Node 22 release that loads ES modules through `require()` without a
+flag, the same property the 20.19 floor provided.
+
+**CI tests every change on Node 22, 24 and 26.** It tested Node 20 alone before.
+
+**Releases are built on Node 26**, where they were built on Node 22.
+Node 26 ships npm 11.20, which already carries Trusted Publishing, so the
+release job no longer downloads npm 11 separately.
+
 ## 1.5.2 (2026-10-07)
 
 Documentation. No source change.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kxco-pq-audit",
-  "version": "1.5.2",
+  "version": "1.6.0",
   "description": "Tamper-evident post-quantum audit trail for regulated institutions. ML-DSA-87 or ML-DSA-65 signed, SHA-256 hash-chained entries: any edit, gap or reorder fails verification and names the entry. Checkpoints anchored on Armature L1.",
   "keywords": [
     "ml-dsa-87",
@@ -68,7 +68,7 @@
     "ASSESSMENT.md"
   ],
   "engines": {
-    "node": ">=20.19"
+    "node": ">=22.12"
   },
   "dependencies": {
     "@noble/hashes": "2.4.0",