checkdigit · carlansley · Sep 2, 2026 · Sep 2, 2026
diff --git a/.github/workflows/check-published-scheduled.yml b/.github/workflows/check-published-scheduled.yml
@@ -6,17 +6,14 @@ on:
 
 jobs:
   checkPublished:
-    runs-on: ubuntu-latest
     name: Check Published
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
+        uses: actions/checkout@v7
       - name: Check Published
         uses: checkdigit/github-actions/check-published@main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN_PUBLISH }}
           DEBUG: '*'
           SLACK_PUBLISH_MISMATCH: ${{ secrets.SLACK_PUBLISH_MISMATCH }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -14,19 +14,17 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: ['22.x', '23.x']
+        node-version: ['24.x', '26.x']
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
       - name: Install Dependencies
         run: npm ci --ignore-scripts
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: Compile
         run: npm run ci:compile
       - name: Check Code Style
@@ -41,21 +39,19 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node-version: ['22.x', '23.x']
+        node-version: ['24.x', '26.x']
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: 'npm'
       - name: Install Dependencies
         run: npm ci --ignore-scripts
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: Compile
         run: npm run ci:compile
       - name: Check Code Style

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -24,8 +24,8 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
@@ -2,43 +2,69 @@ name: Coverage
 
 on:
   pull_request:
-    branches:
-      - 'main'
+    branches: [main]
 
-env:
-  CI: true
+concurrency:
+  group: coverage-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
-  coverage:
+  base:
     runs-on: ubuntu-latest
-    name: Coverage
     steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '26.x'
+          cache: 'npm'
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+      - name: Run coverage
+        run: npm run ci:coverage
+      - uses: actions/upload-artifact@v7
+        with:
+          name: base-coverage
+          path: coverage/lcov.info
+          if-no-files-found: error
+
+  pr:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - name: Use Node.js
-        uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
-          node-version: '22.x'
+          node-version: '26.x'
           cache: 'npm'
-      - name: Install Dependencies
+      - name: Install dependencies
         run: npm ci --ignore-scripts
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - name: Calculate Code Coverage
+      - name: Run coverage
         run: npm run ci:coverage
-      - name: Create Coverage Report for base branch
-        run: |
-          mv coverage/lcov.info coverage/lcov_head.info
-          git fetch
-          git checkout origin/${{ github.event.pull_request.base.ref }}
-          npm ci --ignore-scripts && npm run ci:coverage
-        env:
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      - name: Post Coverage Report
+      - uses: actions/upload-artifact@v7
+        with:
+          name: pr-coverage
+          path: coverage/lcov.info
+          if-no-files-found: error
+
+  report:
+    name: Coverage
+    needs: [base, pr]
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require successful coverage jobs
+        if: ${{ needs.base.result != 'success' || needs.pr.result != 'success' }}
+        run: exit 1
+      - uses: actions/download-artifact@v8
+        with: { name: base-coverage, path: coverage }
+      - uses: actions/download-artifact@v8
+        with: { name: pr-coverage, path: coverage-pr }
+      - name: Post coverage report
         uses: checkdigit/github-actions/coverage-reporter@main
         with:
-          lcov-file: 'coverage/lcov_head.info'
-          lcov-base: 'coverage/lcov.info'
+          coverage-results-folder-pr: 'coverage-pr'
+          coverage-results-folder-base: 'coverage'
           delete-old-comments: true
diff --git a/.github/workflows/publish-beta.yml b/.github/workflows/publish-beta.yml
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -3,25 +3,64 @@ name: Publish
 on:
   release:
     types: [created]
+  pull_request:
+    branches:
+      - 'main'
 
 jobs:
   publish:
+    name: ${{ github.event_name == 'release' && 'Publish Release' || 'Publish Beta' }}
+    if: >-
+      (github.event_name == 'release' && github.event.action == 'created') ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.base.ref == 'main' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
+    environment: npm-publish
     permissions:
       contents: read
       id-token: write
-    name: Publish to NPM
+      pull-requests: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - name: Checkout Code
+        uses: actions/checkout@v7
         with:
-          node-version: '22.x'
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '26.x'
+          package-manager-cache: false
           registry-url: 'https://registry.npmjs.org'
-      - name: Install dependencies
+      - name: Check Label
+        if: github.event_name == 'pull_request'
+        uses: checkdigit/github-actions/check-label@main
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check Imports
+        if: github.event_name == 'pull_request'
+        uses: checkdigit/github-actions/check-imports@main
+      - name: Install Dependencies
         run: npm ci --ignore-scripts
       - name: Audit Signatures
         run: npm audit signatures
-      - name: Publish
-        run: npm publish --provenance
+      - name: Run Test
+        if: github.event_name == 'pull_request'
+        run: npm run ci:test
+      - name: Prepare Beta
+        if: github.event_name == 'pull_request'
+        id: prepare-beta
+        uses: checkdigit/github-actions/prepare-beta@main
+      - name: Publish Release
+        if: github.event_name == 'release'
+        run: npm publish
+      - name: Publish Beta
+        if: github.event_name == 'pull_request'
+        run: npm publish --tag beta
+      - name: Comment npm publish result
+        if: github.event_name == 'pull_request'
+        uses: checkdigit/github-actions/comment-npm-publish@main
+        with:
+          betaPackage: ${{ steps.prepare-beta.outputs.betaPackage }}
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_PUBLISH }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/LICENSE.txt b/LICENSE.txt
@@ -1,7 +1,7 @@
 
 The MIT License
 
-Copyright (c) 2021-2025 Check Digit, LLC
+Copyright (c) 2021-2026 Check Digit, LLC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -19,4 +19,4 @@ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+THE SOFTWARE.
diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # Hash
 
-Copyright © 2021-2025 [Check Digit, LLC](https://checkdigit.com)
+Copyright © 2021-2026 [Check Digit, LLC](https://checkdigit.com)
 
 Hash is a small function for Check Digit services to create a UUID derived from a hash generated from a given value.
 

diff --git a/SECURITY.md b/SECURITY.md
@@ -2,12 +2,12 @@
 
 ## Supported Versions
 
-These versions of @checkdigit/hash are currently being supported with security updates.
+These versions of `@checkdigit/hash` are currently being supported with security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| > 4.x   | :white_check_mark: |
-| < 4.0   | :x:                |
+| \>= 5.0 | :white_check_mark: |
+| \< 5.0  | :x:                |
 
 ## Reporting a Vulnerability