feat(runtime): deprecate Node.js 20 and refresh dependencies

[ihor-sokoliuk]

Summary

• deprecate Node.js 20 while keeping the existing >=20 compatibility contract
• recommend Node.js 22+ and test Node 20, 22, 24, and 26.7.0 in CI
• combine the compatible dependency and immutable action-pin updates from chore(deps): bump express-rate-limit from 8.6.1 to 8.6.2 #242, chore(deps): bump the github-actions group across 1 directory with 4 updates #243, and chore(deps-dev): bump the dev-dependencies group across 1 directory with 4 updates #247
• keep unpdf at 1.7.0 because the update in chore(deps): bump unpdf from 1.7.0 to 1.8.1 #246 requires Node.js 22+

Verification

• npm ci, lint, build, and 736/736 coverage tests
• 28/28 E2E tests and packed-consumer verification
• clean npm audit
• official Node.js 20.20.2 and 26.7.0 compatibility runs
• workflow parsing and exact metadata contract checks

Supersedes #242, #243, and #247.

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 medium

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Complexity	1 medium

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

This PR updates the project’s published Node.js support messaging and CI coverage while refreshing a set of dependencies and GitHub Action pins, and adds/extends documentation-oriented unit tests to enforce those public contracts going forward.

Changes:

• Update README runtime guidance to deprecate (but still support) Node.js 20 and recommend Node.js 22+.
• Expand CI Node matrix to test 20, 22, 24, and 26.7.0; refresh several pinned GitHub Actions SHAs.
• Bump dev tooling dependencies (typescript-eslint, ESLint, tsx) and add/extend unit tests that validate public workflow/documentation metadata.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Updates the installation/runtime guidance to reflect the new Node support policy messaging.
package.json	Refreshes devDependencies used for linting/testing/build workflows.
package-lock.json	Locks updated dependency graph and integrity hashes for the refreshed dependencies.
.github/workflows/scorecard.yml	Updates pinned CodeQL action SHA used for SARIF upload.
.github/workflows/docker-rebuild.yml	Updates pinned docker/login-action SHA (but still contains an older CodeQL upload-sarif pin elsewhere in-file).
.github/workflows/docker-publish.yml	Updates pinned docker/login-action SHA (but still contains an older CodeQL upload-sarif pin elsewhere in-file).
.github/workflows/codeql.yml	Updates pinned CodeQL init/analyze action SHAs.
.github/workflows/ci.yml	Expands the Node version matrix to add 22 and 26.7.0.
tests/unit/documentation.test.ts	Adds validations to keep README/workflow “public contract” metadata aligned (Node policy, CI matrix, action pin expectations, dependabot guard).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ihor-sokoliuk]

Review findings handled in f6d8523: split the Dependabot ignore detector into small pure helpers and split the Node/runtime workflow assertions into focused helpers. Both Codacy complexity findings were treated as valid; no findings were left unchanged.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (3)

.github/workflows/docker-publish.yml:86

• This workflow still pins github/codeql-action/upload-sarif to the old v4.37.3 SHA (line 63). Since this PR updates CodeQL action pins elsewhere, update the Trivy SARIF upload step here to the same v4.37.7 commit SHA for consistency and to match the stated dependency refresh.

      - name: Log in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

.github/workflows/docker-rebuild.yml:152

• This workflow still uses github/codeql-action/upload-sarif pinned to the old v4.37.3 SHA (line 108). If the goal is to refresh the immutable action pins, update that SARIF upload step to the same v4.37.7 SHA used in codeql.yml/scorecard.yml so CodeQL is consistently pinned across workflows.

      - name: Log in to Docker Hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:

tests/unit/documentation.test.ts:401

• The new workflow-metadata contract test checks CodeQL action pins only for codeql.yml and scorecard.yml, but docker-publish.yml and docker-rebuild.yml also contain github/codeql-action/upload-sarif steps. If the intent is to prevent pin drift repo-wide, include those docker workflows in assertCodeqlActionPins checks as well (similar to how assertDockerLoginPin is applied to both).

    assertCiMatrix(ci);
    assertCiCommonJob(ci);
    assertCodeqlActionPins(codeql);
    assertCodeqlActionPins(scorecard);
    assertDockerLoginPin(dockerPublish);
    assertDockerLoginPin(dockerRebuild);
    assertDependabotUnpdfPolicy(dependabot);

[ihor-sokoliuk]

Review findings handled in f049e3a: updated the two missed Docker upload-sarif pins to the verified CodeQL v4.37.7 commit and extended the metadata contract to cover them. The ESLint engine comment was left unchanged because ESLint is development-only and the official Node 20.20.2 contributor gate passes.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated no new comments.