kxco-verify 1.4.0 → 1.5.0

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 1.5.0 (2026-10-09)
+
+Runtime support. No change to the API or its behaviour.
+
+**Node.js 22.12 or later is required.** `engines.node` moves from `>=20.19`
+to `>=22.12`. Node 20 reached end of life on 30 April 2026. 22.12 is the
+first Node 22 release that loads ES modules through `require()` without a
+flag, the same property the 20.19 floor provided.
+
+**CI tests every change on Node 22, 24 and 26.** It tested Node 18, 20 and 22 before.
+
+**Releases are built on Node 26**, where they were built on Node 24.
+
+## 1.4.1
+
+Documentation. No source change.
+
+The package description, the opening of the README and the keywords now say
+what 1.4.0 already does: it verifies ML-DSA-87 signatures as well as ML-DSA-65.
+The description now fits the 255 characters the npm registry keeps, so it no
+longer ends mid-sentence. `ml-dsa-87` joins the keywords.
+
 ## 1.4.0
 ML-DSA-87 manifests verify alongside ML-DSA-65. parseManifest accepts
 `"ML-DSA-87"` where all three alg fields name it, and requires the public key

package/README.md

@@ -11,7 +11,7 @@
 [![node](https://img.shields.io/node/v/kxco-verify.svg)](https://nodejs.org)
 [![verify.kxco.ai](https://img.shields.io/badge/verify.kxco.ai-live-22c55e)](https://verify.kxco.ai)
 
-Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-65 signed documents. One dependency, pinned exactly. Works in any modern browser and in Node.js 20.19 and later.
+Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-87 and ML-DSA-65 signed documents. One dependency, pinned exactly. Works in any modern browser and in Node.js 22.12 and later.
 
 - **No KXCO server in the trust path.** `verifyManifest()` makes no network request at all, and `verifyUrl()` contacts only the attestation URL you pass and the key endpoint the manifest names.
 - **Runs in the browser as shipped.** No `Buffer`, no `process` and SHA-256 from WebCrypto, which is how [verify.kxco.ai](https://verify.kxco.ai) checks a signature entirely in the tab.
@@ -49,7 +49,7 @@ To **sign** attestations, pick the signing package from [the KXCO post-quantum f
 npm install kxco-verify
 ```
 
-Node.js 20.19 and later. ESM only. One dependency, and no KXCO server in the trust path.
+Node.js 22.12 and later. ESM only. One dependency, and no KXCO server in the trust path.
 
 ## Command line
 
@@ -258,7 +258,7 @@ hexEquals(a: string, b: string): boolean
 
 ## Browser usage
 
-The library is browser-safe by construction. It uses no `Buffer` and no `process`, and takes SHA-256 from `crypto.subtle`, which every modern browser and Node.js 20.19 and later provide.
+The library is browser-safe by construction. It uses no `Buffer` and no `process`, and takes SHA-256 from `crypto.subtle`, which every modern browser and Node.js 22.12 and later provide.
 
 Use a bundler (Vite, esbuild, Rollup, webpack), or load as ESM via an import map that points each package at its folder:
 
@@ -322,7 +322,7 @@ version, and every GitHub Action is pinned by commit SHA.
 
 ## Security
 
-**ML-DSA-65** (NIST FIPS 204) via [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) 0.7.0, pinned exactly. No custom cryptography.
+**ML-DSA-87** and **ML-DSA-65** (NIST FIPS 204) via [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) 0.7.0, pinned exactly. No custom cryptography.
 
 Evidenced, and reproducible on your own machine:
 

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "kxco-verify",
-  "version": "1.4.0",
-  "description": "Free, browser-safe verifier for KXCO ML-DSA-65 post-quantum signatures, with no KXCO server in the trust path. An auditor, regulator or counterparty confirms a signature from the artefact alone, years later, and can check the key is still live against the on-chain registry.",
+  "version": "1.5.0",
+  "description": "Free, browser-safe verifier for KXCO ML-DSA-87 and ML-DSA-65 signatures, with no KXCO server in the trust path. An auditor, regulator or counterparty confirms a signature from the artefact alone, years later, and can check the key is still live on chain.",
   "keywords": [
     "post-quantum",
     "pqc",
     "ml-dsa",
+    "ml-dsa-87",
     "dilithium",
     "nist",
     "fips-204",
@@ -77,7 +78,7 @@
     "src"
   ],
   "engines": {
-    "node": ">=20.19"
+    "node": ">=22.12"
   },
   "dependencies": {
     "@noble/post-quantum": "0.7.0"