v0.2.4

Changed

• Requires Node 22 or newer (engines was >=20). Node 20 reached end of life on 2026-04-30, and vitest 5 needs Node 22.12 to run the tests, so CI now runs on Node 22 and 24 instead of 20 and 22.
• Dependencies: zod 4 (runtime), and for development TypeScript 7, @types/node 26, vitest and @vitest/coverage-v8 5 and actions/setup-node 7.1.0.

Fixed

• One reply that resolves two waits on the same thread answers each wait once. Before, handing over the first wait's replies re-entered the waiter check, which answered the second wait, and the outer loop then answered it again from its stale copy (src/broker.ts checkWaiters).
• A reply held for the asker's open murmur_wait no longer sends the replier a queued_delivered note when the wait hands it over. The note reached the replier as a new turn (a live check woke the replying session a second time for it) although nothing had waited on a session that was down. A reply that was not held for the wait, for example one that stayed queued while the asker's session was closed, still sends the note when a later wait hands it over.
• The 200 inbox cap (cap_inbox) counts only deliveries not yet proven delivered to the recipient's session (queued or sent). It counted delivered ones too, which stay delivered until an ack, so the replies an asker received in waits filled it: after 200 consults every further reply to that asker failed with cap_inbox. The unread count in status and inbox is unchanged.

Security

• vitest 5 drops the vulnerable test-only dependencies npm audit reported (tinypool GHSA-5gmw-xhrv-c9v3 and GHSA-85c8-ppgw-ccpr, critical; vitest and @vitest/mocker GHSA-82fw-gwwq-j7x9, moderate). The published package was not affected: npm audit --omit=dev found nothing.