chore(deps): dev-dep security upgrade + drop EOL Node 18 (engines >=20)

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        node-version: ["18", "20", "22"]
+        node-version: ["20", "22", "24"]
 
     steps:
       - uses: actions/checkout@v5

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to `@makegov/tango-node` will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+### Changed
+- **Node.js 20 is now the minimum supported version** (`engines.node >= 20`); the CI matrix moves from 18/20/22 to 20/22/24. Node 18 has been end-of-life since April 2025, and the security-patched test toolchain below requires 20+. Nothing in the published code changed — existing installs on Node 18 keep working, but they are no longer tested or supported.
+- Dev-dependency security upgrade clearing all six open Dependabot alerts (vitest 2.1.9 → 4.x, @vitest/coverage-v8 to match, tsx to the esbuild-0.28 line — the published package is unaffected, its only runtime dependency remains `commander`). One test-only fix for vitest 4's stricter mocks: constructable mocks now use regular-function implementations.
+
 ## [1.2.0] - 2026-08-14
 
 ### Added

README.md

@@ -14,12 +14,12 @@ A modern Node.js SDK for the [Tango API](https://tango.makegov.com), featuring d
 - **Type-Safe by Design** – Shape strings are validated against Tango schemas and mapped to generated TypeScript types.
 - **Full Tango API surface** – Awards (contracts, IDVs, OTAs, OTIDVs, subawards, vehicles, GSA eLibrary), opportunities + notices, forecasts, grants, protests, IT Dashboard, budget accounts, exclusions, SBIR/STTR, DIBBS, entities (with sub-resources), agencies/organizations/offices/departments, lookups (NAICS, PSC, MAS SINs, assistance listings, business types), metrics, resolve/validate, webhooks. See `## API Methods` below for the full list.
 - **Flexible Data Access** – Plain JavaScript objects backed by runtime validation and parsing, materialized via the dynamic model pipeline.
-- **Modern Node.js** – Built for Node.js 18+ with native `fetch` and ESM-first design.
+- **Modern Node.js** – Built for Node.js 20+ with native `fetch` and ESM-first design.
 - **Tested Against the Real API** – Integration tests (mirroring the Python SDK) keep behavior aligned.
 
 ## Installation
 
-**Requirements:** Node.js 18 or higher.
+**Requirements:** Node.js 20 or higher.
 
 ```bash
 npm install @makegov/tango-node
@@ -398,7 +398,7 @@ See [docs/DEVELOPERS.md](docs/DEVELOPERS.md) for the conformance architecture an
 
 ## Requirements
 
-- Node.js 18 or higher.
+- Node.js 20 or higher.
 - A valid [Tango API key](https://tango.makegov.com/).
 
 ## Documentation

docs/DEVELOPERS.md

@@ -118,7 +118,7 @@ const second = await client.listContracts({ shape: "key,piid" });
 npm install @makegov/tango-node
 ```
 
-Requires Node 18 or higher (uses native `fetch`).
+Requires Node 20 or higher (uses native `fetch`).
 
 ### Basic Usage