---
url: https://masyaka.github.io/injecute/guide/versioning.md
description: >-
  What counts as a breaking change, which TypeScript versions and runtimes are
  supported, and how releases are published.
---

# Versioning and support

injecute follows [semantic versioning](https://semver.org). Breaking changes only happen in a major
version, and each one comes with a before/after entry in a migration guide.

## What the public API is

* Everything exported from `injecute` (the package root), with the behaviour its docs describe, and the
  `injecute/hints` entry point.
* The TypeScript types of those exports, following the
  [Semantic Versioning for TypeScript Types](https://www.semver-ts.org) policy: a change that makes
  correct code stop compiling is breaking. Fixing a type so that it rejects code that already failed at
  runtime is a bug fix.
* Error `code` values (`INJECUTE_*`). New codes can be added in minor versions. Error **messages** are
  not part of the API: they get better over time, so branch on `code`.

Not part of the API: anything marked `@internal`, files imported by path (`injecute/lib/…`), and the
exact text of messages and hints, including whether a browser bundle prints the hints (see
[Hints in browser bundles](../errors/index.md#hints-in-browser-bundles)).

Every export of the package root, with its type and the members of its classes and interfaces, is
recorded in a snapshot that the test suite compares on every change. An API change can't slip in by
accident: it updates the snapshot on purpose, with a changeset, and a migration note when it breaks.

## Deprecations

A renamed API keeps working under its old name, marked `@deprecated` with the replacement, until the next
major version. Your editor shows the deprecation and the replacement.

## Support

| Version                | Fixes                                                                |
| ---------------------- | -------------------------------------------------------------------- |
| The latest major (1.x) | bug and security fixes, in the latest minor version                  |
| The previous major     | bug and security fixes for **6 months** after the next major ships   |
| 0.x                    | none: upgrade with the [migration guide](../migration/0.x-to-1.0.md) |

Fixes for a previous major are released as patch versions of its latest minor. Report security issues
privately, through [GitHub security advisories](https://github.com/Masyaka/injecute/security/advisories/new),
not as an issue.

## TypeScript

TypeScript **5.2 and newer**, checked in CI against 5.2 and the latest release, and weekly against the
next one. The minimum is raised only in a minor release, announced in the changelog.

## Runtimes

Node.js **22.12 and newer**, current Deno and Bun, and browsers that support ES2022 modules. Raising the
minimum Node.js version is a breaking change.

Why 22.12: injecute is a single ES module. Node.js 22.12 is the first 22.x release where `require()`
loads ES modules without a flag, so CommonJS code can still `require('injecute')`. Node.js 20 reached
its end of life in April 2026. CI runs the tests on Node.js 22, 24 and 26, and the package smoke tests
(`import` and `require()`) on 22.12, the minimum.

## Releases

Every release is published from GitHub Actions to [npm](https://www.npmjs.com/package/injecute) (with
provenance) and [JSR](https://jsr.io/@masyaka/injecute), with notes in the [changelog](../changelog.md)
and on [GitHub Releases](https://github.com/Masyaka/injecute/releases). Release candidates use the npm
dist-tag `rc`: `npm install injecute@rc`.