fix: require Node 22+ and round out contribution setup

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,30 @@
+---
+name: Bug report
+about: Something doesn't work as documented
+title: "fix: "
+labels: bug
+---
+
+## What happened
+
+<!-- A clear description of the bug. -->
+
+## Reproduction
+
+```ts
+// Minimal code that triggers it
+```
+
+## Expected vs actual
+
+- **Expected:**
+- **Actual:**
+
+## Environment
+
+- `@dpianelli/chesscom` version:
+- Runtime + version (Node / Deno / Bun / browser):
+
+## Extra context
+
+<!-- Stack trace, the endpoint involved, a sample response, etc. -->

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest a new endpoint, helper, or improvement
+title: "feat: "
+labels: enhancement
+---
+
+## What
+
+<!-- The capability you'd like. For a new endpoint, link the Chess.com docs. -->
+
+## Why
+
+<!-- The use case it unblocks. -->
+
+## Proposed shape
+
+```ts
+// How you'd expect to call it, if you have an idea
+```

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+<!--
+The PR title MUST follow Conventional Commits (feat:, fix:, docs:, chore:, …) and
+include a `!` for breaking changes. We squash-merge, so the title becomes the
+commit message and the changelog entry.
+-->
+
+## What
+
+<!-- A short description of the change and why it's needed. -->
+
+## Checklist
+
+- [ ] PR title follows [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] `npm run check` passes (lint, format, typecheck, tests)
+- [ ] Tests added or updated for the change
+- [ ] README / docs updated if the public API changed

CODE_OF_CONDUCT.md

@@ -0,0 +1,18 @@
+# Code of Conduct
+
+This project adopts the [Contributor Covenant](https://www.contributor-covenant.org),
+version 2.1. The full text is available at
+<https://www.contributor-covenant.org/version/2/1/code_of_conduct/>.
+
+## In short
+
+We want a welcoming, harassment-free experience for everyone. Be respectful and
+constructive; assume good faith. Unacceptable behavior includes harassment,
+personal attacks, and other conduct that a reasonable person would find
+inappropriate in a professional setting.
+
+## Reporting
+
+Report unacceptable behavior to the maintainer at **denis.pianelli@gmail.com**.
+Reports are handled confidentially. Maintainers may remove, edit, or reject
+contributions and comments that violate this Code of Conduct.

CONTRIBUTING.md

@@ -63,6 +63,10 @@ bumps the minor version, a `fix` the patch; mark breaking changes with `!` or a
 ## Pull requests
 
 - Branch from `main`, open a PR back to `main`.
+- **The PR title must follow [Conventional Commits](https://www.conventionalcommits.org/).**
+  PRs are **squash-merged**, so the PR title becomes the commit message on `main` —
+  it is what `release-please` reads to build the changelog and choose the next
+  version. A non-conventional title is silently dropped from the release notes.
 - CI must pass (lint, format, typecheck, test, build on Node 22 and 24).
 - Match the surrounding code; see [`STYLE.md`](./STYLE.md) for conventions and
   [`SPEC.md`](./SPEC.md) for the architecture.

README.md

@@ -14,7 +14,7 @@ rate limiting, ETag caching, runtime response validation, and lazy pagination.
 - ✅ Serial rate limiting + backoff (respects the Chess.com "be serial" rule)
 - ✅ Transparent ETag caching (`304 Not Modified` aware)
 - ✅ Lazy async iteration over monthly game archives
-- ✅ Isomorphic — native `fetch`, runs in Node 18+, Deno, Bun, the browser
+- ✅ Isomorphic — native `fetch`, runs in Node 22+, Deno, Bun, the browser
 - ✅ One dependency (`zod`)
 
 > ✅ Stable since `1.0.0`. The public API follows [semver](https://semver.org) —
@@ -247,7 +247,7 @@ const client = new ChessComClient({
 
 ## Requirements
 
-- The published library runs on **Node 18+**, Deno, Bun, and browsers (anything
+- The published library runs on **Node 22+**, Deno, Bun, and browsers (anything
   with a global `fetch`).
 - Contributing to this repo requires **Node 22+** (the dev toolchain).
 

SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported versions
+
+This project follows [semantic versioning](https://semver.org). Security fixes
+land on the latest released line; please upgrade to the most recent version
+before reporting.
+
+| Version | Supported |
+| ------- | --------- |
+| `1.x`   | ✅        |
+| `< 1.0` | ❌        |
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security problems.**
+
+Use GitHub's private vulnerability reporting:
+[**Report a vulnerability**](https://github.com/denispianelli/chesscom/security/advisories/new),
+or email **denis.pianelli@gmail.com**.
+
+Include a description, affected versions, and a minimal reproduction if possible.
+You can expect an initial acknowledgement within a few days. Once a fix is ready,
+a patched release is published and the advisory is disclosed.

package.json

@@ -42,7 +42,7 @@
   ],
   "sideEffects": false,
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "scripts": {
     "build": "tsup",