kxco-verify 1.4.1 → 1.5.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.5.1 (2026-10-16)
+
+**`@noble/post-quantum` 0.7.0 to 0.7.1, exact pin.** No change to the API or its behaviour.
+
+The hold at 0.7.0 rested on a finding that 0.7.1 failed nine NIST SLH-DSA verification vectors. That finding was a fault in kxco-post-quantum's ACVP runner, corrected there on 15 October 2026, not in 0.7.1. On the corrected runner the full NIST ACVP set on 0.7.1 returns 1793 passed, 0 failed, 310 skipped, the same totals as 0.7.0. 0.7.1 snapshots its options object and rejects options it does not recognise; this package passes none, so nothing on its verification path changes.
+
+## 1.5.0 (2026-10-09)
+
+Runtime support. No change to the API or its behaviour.
+
+**Node.js 22.12 or later is required.** `engines.node` moves from `>=20.19`
+to `>=22.12`. Node 20 reached end of life on 30 April 2026. 22.12 is the
+first Node 22 release that loads ES modules through `require()` without a
+flag, the same property the 20.19 floor provided.
+
+**CI tests every change on Node 22, 24 and 26.** It tested Node 18, 20 and 22 before.
+
+**Releases are built on Node 26**, where they were built on Node 24.
+
 ## 1.4.1
 
 Documentation. No source change.

package/README.md

@@ -11,7 +11,7 @@
 [![node](https://img.shields.io/node/v/kxco-verify.svg)](https://nodejs.org)
 [![verify.kxco.ai](https://img.shields.io/badge/verify.kxco.ai-live-22c55e)](https://verify.kxco.ai)
 
-Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-87 and ML-DSA-65 signed documents. One dependency, pinned exactly. Works in any modern browser and in Node.js 20.19 and later.
+Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-87 and ML-DSA-65 signed documents. One dependency, pinned exactly. Works in any modern browser and in Node.js 22.12 and later.
 
 - **No KXCO server in the trust path.** `verifyManifest()` makes no network request at all, and `verifyUrl()` contacts only the attestation URL you pass and the key endpoint the manifest names.
 - **Runs in the browser as shipped.** No `Buffer`, no `process` and SHA-256 from WebCrypto, which is how [verify.kxco.ai](https://verify.kxco.ai) checks a signature entirely in the tab.
@@ -19,7 +19,7 @@ Standalone post-quantum credential and attestation verifier for KXCO ML-DSA-87 a
 - **Live revocation on request.** `--live` asks the KXCO key registry whether the signing kid is still active, and fails closed.
 - **Made for CI.** `npx kxco-verify <url>` exits 0 for valid, 1 for invalid or revoked, 2 when it cannot fetch or parse and 3 for rotated, with `--json` for machines.
 - **Independent of the signer.** It calls the primitive directly and shares none of the KXCO signing code, so it can be audited on its own.
-- **The primitive NIST's vectors pass.** Verification runs `@noble/post-quantum` 0.7.0, pinned exactly: the version [`kxco-post-quantum`](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/CONFORMANCE.md) holds to 1,793 NIST ACVP vectors passed, 0 failed, and 225 interoperability checks against liboqs, Bouncy Castle and the Python reference implementations, 0 failed.
+- **The primitive NIST's vectors pass.** Verification runs `@noble/post-quantum` 0.7.1, pinned exactly: the version [`kxco-post-quantum`](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/CONFORMANCE.md) holds to 1,793 NIST ACVP vectors passed, 0 failed, and 225 interoperability checks against liboqs, Bouncy Castle and the Python reference implementations, 0 failed.
 
 **The migration has dates.**
 
@@ -49,7 +49,7 @@ To **sign** attestations, pick the signing package from [the KXCO post-quantum f
 npm install kxco-verify
 ```
 
-Node.js 20.19 and later. ESM only. One dependency, and no KXCO server in the trust path.
+Node.js 22.12 and later. ESM only. One dependency, and no KXCO server in the trust path.
 
 ## Command line
 
@@ -258,7 +258,7 @@ hexEquals(a: string, b: string): boolean
 
 ## Browser usage
 
-The library is browser-safe by construction. It uses no `Buffer` and no `process`, and takes SHA-256 from `crypto.subtle`, which every modern browser and Node.js 20.19 and later provide.
+The library is browser-safe by construction. It uses no `Buffer` and no `process`, and takes SHA-256 from `crypto.subtle`, which every modern browser and Node.js 22.12 and later provide.
 
 Use a bundler (Vite, esbuild, Rollup, webpack), or load as ESM via an import map that points each package at its folder:
 
@@ -322,11 +322,11 @@ version, and every GitHub Action is pinned by commit SHA.
 
 ## Security
 
-**ML-DSA-87** and **ML-DSA-65** (NIST FIPS 204) via [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) 0.7.0, pinned exactly. No custom cryptography.
+**ML-DSA-87** and **ML-DSA-65** (NIST FIPS 204) via [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) 0.7.1, pinned exactly. No custom cryptography.
 
 Evidenced, and reproducible on your own machine:
 
-- **1,793 NIST ACVP vectors passed, 0 failed** across FIPS 203, 204 and 205 on `@noble/post-quantum` 0.7.0, pinned by digest, per [CONFORMANCE.md](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/CONFORMANCE.md). The other 310 are pairings the library refuses as weaker than the parameter set
+- **1,793 NIST ACVP vectors passed, 0 failed** across FIPS 203, 204 and 205 on `@noble/post-quantum` 0.7.1, pinned by digest, per [CONFORMANCE.md](https://github.com/KnightsbridgeAIQ/kxco-post-quantum/blob/main/CONFORMANCE.md). The other 310 are pairings the library refuses as weaker than the parameter set
 - **225 interoperability checks passed, 0 failed**, against OpenSSL 3.5, liboqs, Bouncy Castle and dilithium-py/kyber-py, in both directions
 - **SLSA provenance** on every release since 1.2.1: verify with `npm audit signatures`
 - **CycloneDX SBOM** published with every release since 1.2.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kxco-verify",
-  "version": "1.4.1",
+  "version": "1.5.1",
   "description": "Free, browser-safe verifier for KXCO ML-DSA-87 and ML-DSA-65 signatures, with no KXCO server in the trust path. An auditor, regulator or counterparty confirms a signature from the artefact alone, years later, and can check the key is still live on chain.",
   "keywords": [
     "post-quantum",
@@ -78,10 +78,10 @@
     "src"
   ],
   "engines": {
-    "node": ">=20.19"
+    "node": ">=22.12"
   },
   "dependencies": {
-    "@noble/post-quantum": "0.7.0"
+    "@noble/post-quantum": "0.7.1"
   },
   "scripts": {
     "test": "node --test --test-reporter=spec test/parse.test.js test/verify.test.js test/fetch.test.js test/index.test.js test/ml-dsa-87.test.js test/property.test.js",
@@ -106,6 +106,6 @@
   },
   "devDependencies": {
     "fast-check": "4.10.2",
-    "kxco-post-quantum": "1.7.7"
+    "kxco-post-quantum": "1.11.0"
   }
 }