[DWS] Refresh toolchain, move to TypeScript 6, raise minimum Node.js to 22

.github/workflows/ci.yml

@@ -11,12 +11,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Use Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
-        node-version: '20.x'
+        node-version: '22.x'
         cache: 'npm'
 
     - name: Install dependencies
@@ -32,12 +32,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Use Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
-        node-version: '20.x'
+        node-version: '22.x'
         cache: 'npm'
 
     - name: Install dependencies
@@ -68,14 +68,14 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18.x, 20.x]
+        node-version: [22.x, 24.x]
         os: [ubuntu-latest, windows-latest, macos-latest]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'
@@ -86,26 +86,17 @@ jobs:
     - name: Run unit tests with coverage
       run: npm test -- --coverage --testPathPatterns='^((?!integration).)*$'
 
-    - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v3
-      if: matrix.os == 'ubuntu-latest' && matrix.node-version == '20.x'
-      with:
-        file: ./coverage/lcov.info
-        flags: unittests
-        name: codecov-umbrella
-
-
   build:
     runs-on: ubuntu-latest
     needs: [lint-and-type-check, generated-types-drift, unit-tests]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Use Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
-        node-version: '20.x'
+        node-version: '22.x'
         cache: 'npm'
 
     - name: Install dependencies

.github/workflows/integration-tests.yml

@@ -13,13 +13,13 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18.x, 20.x]
+        node-version: [22.x, 24.x]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'

.github/workflows/scheduled-integration-tests.yml

@@ -13,12 +13,12 @@ jobs:
       NUTRIENT_API_KEY: ${{ secrets.NUTRIENT_API_KEY }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Use Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
-        node-version: '20.x'
+        node-version: '22.x'
         cache: 'npm'
 
     - name: Install dependencies
@@ -63,7 +63,7 @@ jobs:
 
     - name: Create issue if tests fail
       if: failure() && steps.test-run.outcome == 'failure'
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         script: |
           const date = new Date().toISOString().split('T')[0];
@@ -104,7 +104,7 @@ jobs:
           }
 
     - name: Upload test artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       if: always()
       with:
         name: scheduled-integration-results-${{ github.run_number }}
@@ -115,7 +115,7 @@ jobs:
 
     - name: Notify on success after previous failure
       if: success() && steps.test-run.outcome == 'success'
-      uses: actions/github-script@v7
+      uses: actions/github-script@v9
       with:
         script: |
           // Close any open integration failure issues

.github/workflows/security.yml

@@ -16,12 +16,12 @@ jobs:
       security-events: write
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
 
     - name: Run Gitleaks
-      uses: gitleaks/gitleaks-action@v2
+      uses: gitleaks/gitleaks-action@v3
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
@@ -55,12 +55,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v7
 
     - name: Use Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v7
       with:
-        node-version: '20.x'
+        node-version: '22.x'
         cache: 'npm'
 
     - name: Install dependencies

CHANGELOG.md

@@ -9,11 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [3.0.0] - 2026-08-03
 
-This release has four breaking changes. Three originate upstream in the DWS
+This release has five breaking changes. Three originate upstream in the DWS
 API spec bump from `1.10.0` to `1.15.1`; the fourth (the `sign()` default
 removal, below) is a deliberate library change to stop overriding the
-server's contract. See `docs/MIGRATION.md` for worked before/after examples
-of each.
+server's contract; the fifth raises the minimum Node.js version to 22. See
+`docs/MIGRATION.md` for worked before/after examples of each.
 
 ### Added
 
@@ -39,10 +39,51 @@ of each.
 
 ### Changed
 
+- **Breaking:** The minimum supported Node.js version is now `22.0.0`, raised
+  from `18.0.0`. Node.js 18 reached end-of-life in April 2025 and Node.js 20
+  in April 2026; neither receives security patches, so neither can be tested
+  or supported. CI now runs against Node.js 22 and 24. There is no API
+  change — if you are already on Node.js 22 or later, nothing in your code
+  needs to change. See `docs/MIGRATION.md`.
 - Updated the vendored OpenAPI spec from `1.10.0` to `1.15.1`.
 - Type generation now passes `--empty-objects-unknown` and
   `--default-non-nullable=false` to `openapi-typescript`, so the generated
   types are reproducible directly from the spec.
+- Updated the development toolchain: ESLint `9.39.2` → `10.8.1` (with
+  `@eslint/js` `9.39.2` → `10.0.1`), `globals` `16.5.0` → `17.9.0`,
+  `@types/node` `24.10.7` → `26.2.0`, `typescript-eslint` `8.53.0` →
+  `8.66.0`, `jest` `30.2.0` → `30.4.2`, `ts-jest` `29.4.6` → `29.4.12`,
+  `prettier` `3.7.4` → `3.9.6`, `openapi-typescript` `7.10.1` → `7.13.0`,
+  and six others to their latest in-range releases. `openapi-typescript`
+  `7.13.0` regenerates both files in `src/generated/` byte-for-byte
+  identically, so no generated type changed.
+- Updated TypeScript from `5.9.3` to `6.0.3`. TypeScript 7 is not yet
+  reachable — `ts-jest@29.4.12` requires `typescript <7` and
+  `typescript-eslint@8.66.0` requires `<6.1.0` — but 6.0 is the supported
+  bridge release toward it, and staying on 5.9 meant sitting on compiler
+  options that 7.0 removes outright. Three changes came with it:
+  - `moduleResolution` moves from `node` (node10) to `bundler`. TypeScript 6
+    deprecates node10 and TypeScript 7 drops it. `bundler` matches how this
+    package is actually built (tsup/esbuild bundles `src/`, and imports are
+    extensionless); `node16`/`nodenext` would have required rewriting every
+    relative import to carry a `.js` extension.
+  - TypeScript 6 no longer implicitly pulls in every `node_modules/@types`
+    package, so the test project now names `jest` and `node` explicitly.
+  - `openapi-typescript@7.13.0` declares a `typescript: ^5.x` peer, which
+    makes `npm ci` fail outright on TypeScript 6. A scoped `overrides` entry
+    relaxes that single peer. The tool itself is unaffected: it regenerates
+    both files in `src/generated/` byte-for-byte identically under 6.0.3,
+    and CI's drift job re-checks that on every run.
+- The `lint` and `lint:fix` scripts no longer pass `--ext .ts`. ESLint 10
+  removes the flag, and it was already redundant under flat config — file
+  coverage is unchanged at 31 files.
+- Updated GitHub Actions: `checkout`, `setup-node` and `upload-artifact` to
+  v7, `github-script` to v9, and `gitleaks-action` v2 → v3. The
+  `gitleaks-action` bump is not optional — v2 runs on the Node 20 Actions
+  runtime, which GitHub removes from hosted runners on 2026-09-16.
+- `npm run typecheck` now also typechecks the test suite. Test files were
+  excluded from the only project `tsc --noEmit` ran against, so they were
+  never typechecked outside of `ts-jest` at test time.
 - **Known limitation:** 1.15.1 widened `WatermarkDimension` (the type of
   `width`/`height`/`top`/`right`/`bottom`/`left` on watermark actions) from
   `{ value, unit }` to `number | string | { value, unit }`, adding a scalar
@@ -77,6 +118,14 @@ of each.
 
 ### Removed
 
+- Removed the Codecov integration. CI still runs the unit tests with
+  `--coverage`, so the thresholds in `jest.config.mjs` (70% branches and
+  functions, 75% lines and statements) continue to gate the build — coverage
+  is simply no longer uploaded to a third-party service.
+- Removed `tsconfig.test.json`. It existed only to give type-aware linting a
+  project containing the tests; that role now belongs to
+  `src/__tests__/tsconfig.json`, which typescript-eslint's project service
+  discovers on its own as the nearest config to those files.
 - **Breaking:** Removed `apiKeys` from the `getAccountInfo()` response type,
   following its removal from the upstream `/account/info` endpoint. If you
   read `accountInfo.apiKeys`, use `createToken()` / `deleteToken()` to manage
@@ -113,6 +162,10 @@ of each.
   the import statement was emitted into the public `.d.ts`. Under
   `skipLibCheck: false`, consumers who didn't happen to have that package on
   disk got `TS2307: Cannot find module`. `ValueOf<T>` is now defined locally.
+- Removed nine redundant type assertions that newer `typescript-eslint`
+  releases correctly flag as unnecessary, in `src/builders/workflow.ts` and
+  two test files, and collapsed one `if (!config || !config.type)` guard to
+  `if (!config?.type)`. All are semantics-preserving.
 
 ### Security
 

docs/CONTRIBUTING.md

@@ -337,7 +337,7 @@ Reviewers will check for:
 
 1. **Setup Development Environment**
    ```bash
-   # Ensure you have Node.js 18.0.0 or higher installed
+   # Ensure you have Node.js 22.0.0 or higher installed
    node --version
 
    # Install dependencies

docs/MIGRATION.md

@@ -133,6 +133,35 @@ const result = await client.sign('document.pdf');
 
 Because `signatureType` and `cadesLevel` no longer exist on the `data` type at all (see 4a), there is no longer a supported way to request CAdES B-LT — or any other specific signature type — through `client.sign()`'s typed `data` parameter. The fields that remain are `flatten`, `formFieldName`, `appearance`, and `position`, none of which control signature type. If your workflow specifically requires CAdES (or another) signature type, consult the current `/sign` API reference for whether and how it's still requestable, and verify your signed output rather than assuming parity with the old default.
 
+### 5) Node.js 18 and 20 are no longer supported — the minimum is now Node.js 22
+
+`engines.node` moves from `>=18.0.0` to `>=22.0.0`. Node.js 18 reached end-of-life in April 2025 and Node.js 20 in April 2026; neither receives security patches, so neither can be tested or supported.
+
+Unlike the four changes above, this one needs **no code change at all**. If you are already on Node.js 22 or later, upgrading is a drop-in replacement.
+
+If you are on Node.js 18 or 20, upgrade your runtime:
+
+```bash
+# Check what you're on
+node --version
+
+# nvm users
+nvm install 22 && nvm use 22
+```
+
+If you cannot upgrade your runtime yet, stay on the last release that supports Node.js 18:
+
+```jsonc
+{
+  "dependencies": {
+    // Receives no further updates, including security fixes.
+    "@nutrient-sdk/dws-client-typescript": "2.1.0"
+  }
+}
+```
+
+Treat that as a short-term measure. `2.1.0` depends on `axios@^1.13.2` and `form-data@^4.0.5`, both of which resolve to releases carrying known high-severity advisories — SSRF via `NO_PROXY` bypass, header injection, authentication bypass through a prototype-pollution gadget, and CRLF injection in multipart bodies. Those fixes ship in `3.0.0` and are not backported. Upgrading Node.js is strongly preferred over pinning.
+
 ## 2.0.0
 
 ### 1) URL inputs now use `FileInputWithUrl`

eslint.config.mjs

@@ -50,7 +50,8 @@ export default defineConfig([
       sourceType: 'module',
 
       parserOptions: {
-        project: ['./tsconfig.json', './tsconfig.test.json'],
+        projectService: true,
+        tsconfigRootDir: __dirname,
       },
     },