diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..10288d2
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,32 @@
+# Weekly dependency updates, each opened as a pull request against main that must pass the `build` check
+# and is merged like any other change (merge commit). Merging releases nothing: a new npm version still
+# needs a GitHub Release (see RELEASING.md).
+version: 2
+updates:
+  # The workflows pin every action to a commit SHA with a `# vX.Y.Z` comment; Dependabot updates both.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      github-actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: ci
+    labels: [dependencies]
+
+  # A bump in "dependencies" raises the minimum version every consumer gets, so it belongs in the
+  # CHANGELOG of the next release. Dev dependencies only affect the build.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      npm-minor-and-patch:
+        update-types: [minor, patch]
+    commit-message:
+      prefix: deps
+    labels: [dependencies]
+    open-pull-requests-limit: 5
diff --git a/.github/examples-base-uri.js b/.github/examples-base-uri.js
new file mode 100644
index 0000000..b910656
--- /dev/null
+++ b/.github/examples-base-uri.js
@@ -0,0 +1,11 @@
+// Preloaded by CI before the examples (node --require): the examples call require('../lib')(token)
+// against the production API, so this points every client they create at CONVERT_API_BASE_URI instead.
+const lib = require.resolve('../lib');
+const ConvertAPI = require(lib);
+
+if (process.env.CONVERT_API_BASE_URI) {
+  require.cache[lib].exports = (credentials, options = {}) => ConvertAPI(
+    credentials,
+    Object.assign({ baseUri: process.env.CONVERT_API_BASE_URI }, options),
+  );
+}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..a5f557f
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,151 @@
+name: Build
+run-name: >-
+  ${{ github.event_name == 'pull_request' && format('Checking that #{0} builds', github.event.pull_request.number)
+   || format('Building {0}', github.ref_name) }}
+
+# Trunk-based: main is the only long-lived branch. Every pull request and every push to main lints, tests
+# and builds the package on each supported Node.js LTS line and packs it, but nothing is published here:
+# this is a public npm package, and npm versions are permanent, so a release is a deliberate act -
+# publishing a GitHub Release v{semver}, which runs publish.yml. The required status check is the last
+# job's name, `build`, which passes only when every Node.js version passed.
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# A newer push to the same pull request cancels the older build; builds of main never cancel each other.
+concurrency:
+  group: build-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  # The tests and the examples convert real files, so they run against the staging API with a staging
+  # token. Pull requests from forks get no secrets, so their tests fail until an admin merges them.
+  CONVERT_API_BASE_URI: https://stag-v2.convertapi.com/
+
+jobs:
+  test:
+    name: test (Node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [20, 22, 24]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+
+      # --ignore-scripts: no dependency runs install scripts on the runner.
+      - name: Install
+        run: npm ci --ignore-scripts
+
+      - name: Lint and test
+        env:
+          CONVERT_API_SECRET: ${{ secrets.CONVERTAPI_STAGING_TOKEN }}
+        run: |
+          if [ -z "$CONVERT_API_SECRET" ]; then
+            echo "::error::The CONVERTAPI_STAGING_TOKEN secret is not available to this run (a pull request from a fork gets no secrets)"
+            exit 1
+          fi
+          npm test
+
+      - name: Build
+        run: npm run build
+
+      # The examples call the production API and catch and print their own errors, so the preload points
+      # them at CONVERT_API_BASE_URI and any printed error fails the step.
+      - name: Run the examples
+        env:
+          API_TOKEN: ${{ secrets.CONVERTAPI_STAGING_TOKEN }}
+        run: |
+          set -euo pipefail
+          node --require ./.github/examples-base-uri.js examples/ 2>&1 | tee examples.log
+          if grep -q '^Error' examples.log; then
+            echo "::error::An example failed, see the errors above"
+            exit 1
+          fi
+
+  build:
+    name: build
+    needs: test
+    # Runs even when a test job failed, so that the required check reports a failure instead of being
+    # skipped (a skipped required check counts as passed).
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check every Node.js version passed
+        env:
+          RESULT: ${{ needs.test.result }}
+        run: |
+          if [ "$RESULT" != success ]; then
+            echo "::error::The tests did not pass on every Node.js version ($RESULT)"
+            exit 1
+          fi
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install
+        run: npm ci --ignore-scripts
+
+      # A high or critical advisory in what consumers install (dev dependencies are not shipped) fails the
+      # build rather than reaching a release.
+      - name: Audit the runtime dependencies
+        run: npm audit --omit=dev --audit-level=high
+
+      - name: Build
+        run: npm run build
+
+      # A pre-release version that sorts below any real release and names the run, so a package
+      # downloaded from this run can be tried out but never mistaken for a published one.
+      - name: Pack
+        id: pack
+        env:
+          RUN: ${{ github.run_number }}
+          SHORT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          set -euo pipefail
+          VERSION="0.0.0-ci.$RUN.g${SHORT_SHA:0:7}"
+          npm version "$VERSION" --no-git-tag-version --ignore-scripts
+          mkdir out
+          npm pack --ignore-scripts --pack-destination out
+          test -f "out/convertapi-$VERSION.tgz"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: convertapi-${{ steps.pack.outputs.version }}
+          path: out/
+          retention-days: 14
+          if-no-files-found: error
+
+      - name: Summary
+        env:
+          VERSION: ${{ steps.pack.outputs.version }}
+        run: |
+          {
+            echo "| | |"
+            echo "|---|---|"
+            echo "| Package | \`convertapi $VERSION\` (artifact only, not published) |"
+            echo "| Dependencies | $(jq -r '.dependencies | to_entries | map("\(.key) \(.value)") | join(", ")' package.json) |"
+            echo "| Files | $(tar -tzf "out/convertapi-$VERSION.tgz" | wc -l) |"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
deleted file mode 100644
index 88cc140..0000000
--- a/.github/workflows/main.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Build
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version:
-          - 21
-          - 20
-          - 18
-          - 16
-    name: Node ${{ matrix.node-version }} sample
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
-        with:
-          node-version: ${{ matrix.node-version }}
-      - run: npm install --ignore-scripts
-      - env:
-          CONVERT_API_SECRET: ${{ secrets.CONVERTAPI_SECRET }}
-        run: npm test
-      - run: npm run build
-      - env:
-          CONVERT_API_SECRET: ${{ secrets.CONVERTAPI_SECRET }}
-        run: npm run test:examples
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9bc5fd8..62e4bcb 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,21 +1,218 @@
-name: Publish package to npmjs
+name: Publish
+run-name: Publishing convertapi ${{ github.event.release.tag_name }} to npm
+
+# A release is a GitHub Release, never a merge. Merging to main only builds (build.yml); publishing the
+# Release v{semver} runs this file, which tests and builds that tag's commit with the tag's version and
+# publishes it to npm with provenance. npm versions are public and permanent - a published version can be
+# deprecated but never replaced - so nothing here retries, overwrites or skips a duplicate.
+#
+#   gh release create v1.15.1 --target main --generate-notes            -> convertapi 1.15.1 (latest)
+#   gh release create v1.16.0-beta.1 --target main --prerelease ...     -> convertapi 1.16.0-beta.1 (next)
+#
+# A stable version must be a commit on main. A pre-release may be any commit, so a branch can be tried
+# out as a preview package before it is merged.
 on:
   release:
     types: [published]
+
+permissions:
+  contents: read
+
+env:
+  # Only this account may publish a Release that reaches npm. GitHub cannot express this as a permission
+  # on the Team plan, so it is checked here; the real controls are the v* tag ruleset (only repository
+  # admins create v* tags) and the npm environment, which accepts only v* tags.
+  PUBLISHER: tomasr78
+  PACKAGE: convertapi
+  CONVERT_API_BASE_URI: https://stag-v2.convertapi.com/
+
 jobs:
-  build:
+  publish:
+    name: publish
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment:
+      name: npm
+      url: https://www.npmjs.com/package/convertapi/v/${{ steps.tag.outputs.version }}
+    concurrency:
+      group: publish-npm
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      # For npm Trusted Publishing, which trades this run's OIDC token for a short-lived publish token,
+      # and for the provenance statement, which is signed with it.
+      id-token: write
     steps:
-      - uses: actions/checkout@v4
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v3
+      - name: Check who published the release
+        run: |
+          # A re-run keeps GITHUB_ACTOR as the original user; GITHUB_TRIGGERING_ACTOR is whoever pressed
+          # "Re-run", so both must be the publisher or anyone with write access could replay a release.
+          if [ "$GITHUB_ACTOR" != "$PUBLISHER" ] || [ "${GITHUB_TRIGGERING_ACTOR:-$GITHUB_ACTOR}" != "$PUBLISHER" ]; then
+            echo "::error::Only $PUBLISHER may publish to npm - this release was published by $GITHUB_ACTOR and run by ${GITHUB_TRIGGERING_ACTOR:-$GITHUB_ACTOR}."
+            exit 1
+          fi
+          echo "Published by $GITHUB_ACTOR"
+
+      # The release event runs this file from the tag, so the workflow and the code come from the same commit.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm ci
+          fetch-depth: 0
+          persist-credentials: false
+
+      # Node 24 ships npm 11, which Trusted Publishing needs. No dependency cache: a publishing job must
+      # not restore anything another run could have written.
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      - name: Check the tag and the version
+        id: tag
+        env:
+          TAG: ${{ github.event.release.tag_name }}
+          PRERELEASE: ${{ github.event.release.prerelease }}
+        run: |
+          set -euo pipefail
+          # SemVer 2.0 without build metadata (npm drops "+..." and it would only confuse).
+          SEMVER='^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$'
+          if ! [[ "$TAG" =~ $SEMVER ]]; then
+            echo "::error::Tag '$TAG' is not v{major}.{minor}.{patch} or v{major}.{minor}.{patch}-{pre-release}, e.g. v1.15.1 or v1.16.0-beta.1"
+            exit 1
+          fi
+          if [ "$GITHUB_REF" != "refs/tags/$TAG" ]; then
+            echo "::error::The run is on $GITHUB_REF, not on the release tag refs/tags/$TAG"
+            exit 1
+          fi
+          VERSION="${TAG#v}"
+          SHA=$(git rev-parse "refs/tags/$TAG^{commit}")
+          if [ "$(git rev-parse HEAD)" != "$SHA" ]; then
+            echo "::error::Checked out $(git rev-parse HEAD), but $TAG points at $SHA"
+            exit 1
+          fi
+
+          # The GitHub "pre-release" tick and the version must agree, so a preview cannot become the
+          # package's latest version by a forgotten tick, and a stable version cannot hide as a pre-release.
+          if [[ "$VERSION" == *-* ]]; then
+            if [ "$PRERELEASE" != true ]; then
+              echo "::error::$TAG is a pre-release version, so the GitHub Release must be marked as a pre-release (gh release create --prerelease)"
+              exit 1
+            fi
+            DIST_TAG=next
+          else
+            if [ "$PRERELEASE" = true ]; then
+              echo "::error::$TAG is a stable version, but the GitHub Release is marked as a pre-release. Use a pre-release version such as ${TAG}-beta.1, or untick pre-release."
+              exit 1
+            fi
+            if ! git merge-base --is-ancestor "$SHA" origin/main; then
+              echo "::error::$TAG ($SHA) is not on main. Stable versions are released from main only; release a branch as a pre-release instead."
+              exit 1
+            fi
+            DIST_TAG=latest
+          fi
+
+          # The registry lists every version ever published, deprecated ones included.
+          META=$(curl -fsS --retry 3 "https://registry.npmjs.org/$PACKAGE")
+          if jq -e --arg v "$VERSION" '.versions | has($v)' <<<"$META" >/dev/null || \
+             jq -e --arg v "$VERSION" '.time | has($v)' <<<"$META" >/dev/null; then
+            echo "::error::$PACKAGE $VERSION already exists on npm (or was unpublished) and can never be published again. Release the next version instead."
+            exit 1
+          fi
+          # A stable version below the current latest (a backport) must not take the `latest` dist-tag,
+          # or new installs would go back to it.
+          LATEST=$(jq -r '."dist-tags".latest // empty' <<<"$META")
+          if [ "$DIST_TAG" = latest ] && [ -n "$LATEST" ] && \
+             [ "$(printf '%s\n%s\n' "$LATEST" "$VERSION" | sort -V | tail -n1)" != "$VERSION" ]; then
+            echo "::warning::$VERSION is lower than the latest $LATEST, so it is published under the dist-tag 'maintenance' and new installs keep getting $LATEST."
+            DIST_TAG=maintenance
+          fi
+
+          {
+            echo "version=$VERSION"
+            echo "sha=$SHA"
+            echo "dist-tag=$DIST_TAG"
+          } >> "$GITHUB_OUTPUT"
+          echo "Publishing $PACKAGE $VERSION from $SHA under the dist-tag $DIST_TAG"
+
+      # --ignore-scripts here and below: no lifecycle script runs in a job that can publish.
+      - name: Install
+        run: npm ci --ignore-scripts
+
+      - name: Audit the runtime dependencies
+        run: npm audit --omit=dev --audit-level=high
+
+      - name: Lint and test
+        env:
+          CONVERT_API_SECRET: ${{ secrets.CONVERTAPI_STAGING_TOKEN }}
+        run: npm test
+
+      - name: Set the version and build
+        env:
+          VERSION: ${{ steps.tag.outputs.version }}
+        run: |
+          set -euo pipefail
+          npm version "$VERSION" --no-git-tag-version --allow-same-version --ignore-scripts
+          npm run build
+
+      - name: Check the package
+        env:
+          VERSION: ${{ steps.tag.outputs.version }}
+        run: |
+          set -euo pipefail
+          mkdir out
+          npm pack --ignore-scripts --pack-destination out
+          TGZ="out/$PACKAGE-$VERSION.tgz"
+          test -f "$TGZ"
+          PKG_JSON=$(tar -xzOf "$TGZ" package/package.json)
+          [ "$(jq -r .version <<<"$PKG_JSON")" = "$VERSION" ] || { echo "::error::$TGZ does not carry version $VERSION"; exit 1; }
+          tar -tzf "$TGZ" | grep -qx 'package/lib/index.js' || { echo "::error::$TGZ has no lib/index.js"; exit 1; }
+          tar -tzf "$TGZ"
+
+      # Trusted Publishing: once npmjs.com trusts this repository, publish.yml and the npm environment,
+      # setting the repository variable NPM_TRUSTED_PUBLISHING to true publishes with a short-lived OIDC
+      # token instead of the NPM_TOKEN secret, which can then be deleted. Both ways publish with provenance.
+      # No --force and no retry: a version that already exists must fail loudly, never pass as published.
+      - name: Publish to npm
+        env:
+          VERSION: ${{ steps.tag.outputs.version }}
+          DIST_TAG: ${{ steps.tag.outputs.dist-tag }}
+          NODE_AUTH_TOKEN: ${{ vars.NPM_TRUSTED_PUBLISHING != 'true' && secrets.NPM_TOKEN || '' }}
+          TRUSTED: ${{ vars.NPM_TRUSTED_PUBLISHING == 'true' }}
+        run: |
+          set -euo pipefail
+          if [ "$TRUSTED" != true ] && [ -z "$NODE_AUTH_TOKEN" ]; then
+            echo "::error::No npm credentials: set up Trusted Publishing (NPM_TRUSTED_PUBLISHING) or the NPM_TOKEN secret"
+            exit 1
+          fi
+          npm publish "out/$PACKAGE-$VERSION.tgz" --provenance --access public --tag "$DIST_TAG" --ignore-scripts
+
+      # The registry usually serves a new version within seconds. A slow registry is not a failed release,
+      # so this only warns.
+      - name: Wait for npm to serve the package
         env:
-          CONVERT_API_SECRET: ${{ secrets.CONVERTAPI_SECRET }}
-      - run: npm publish
+          VERSION: ${{ steps.tag.outputs.version }}
+        run: |
+          set -uo pipefail
+          for _ in $(seq 1 20); do
+            if curl -fsS "https://registry.npmjs.org/$PACKAGE/$VERSION" >/dev/null 2>&1; then
+              echo "$PACKAGE $VERSION is available on npm"
+              exit 0
+            fi
+            sleep 15
+          done
+          echo "::warning::$PACKAGE $VERSION was published but npm has not served it after 5 minutes. Check https://www.npmjs.com/package/$PACKAGE/v/$VERSION"
+
+      - name: Summary
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          CONVERT_API_SECRET: ${{ secrets.CONVERTAPI_SECRET }}
+          VERSION: ${{ steps.tag.outputs.version }}
+          SHA: ${{ steps.tag.outputs.sha }}
+          DIST_TAG: ${{ steps.tag.outputs.dist-tag }}
+          AUTH: ${{ vars.NPM_TRUSTED_PUBLISHING == 'true' && 'Trusted Publishing' || 'NPM_TOKEN secret' }}
+        run: |
+          {
+            echo "| | |"
+            echo "|---|---|"
+            echo "| Package | [\`$PACKAGE $VERSION\`](https://www.npmjs.com/package/$PACKAGE/v/$VERSION) (dist-tag \`$DIST_TAG\`) |"
+            echo "| Commit | \`$SHA\` |"
+            echo "| Published with | $AUTH, with provenance |"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..3256bc2
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,25 @@
+# Changelog
+
+All notable changes to the `convertapi` npm package. Versions follow [Semantic Versioning](https://semver.org/);
+each one is a GitHub Release `v{version}` (see [RELEASING.md](RELEASING.md)).
+
+## 1.15.1 - 2026-10-20
+
+- Require axios 1.20.0 or later (was 1.6.2), which pulls in fixed follow-redirects and form-data. This
+  closes the high and critical advisories in what `npm install convertapi` resolves, among them
+  GHSA-jqh4-m9w3-8hp9, GHSA-fjxv-7rqg-78g4 and GHSA-r4q5-vmmm-2653.
+- The examples and README use an API token (`API_TOKEN`) instead of the retired secret and API key.
+- The PDF thumbnail example converts the first page straight to JPG (`PageRange: 1`), since `pdf → extract`
+  is now the data-extraction converter and returns JSON.
+- `package.json` points at the renamed repository, https://github.com/ConvertAPI/convertapi-library-node.
+- Published from GitHub Actions with npm provenance. Tested on Node.js 20, 22 and 24.
+
+## 1.15.0 - 2024-09-14
+
+- Authenticate with the `Authorization` header.
+- Remove alternative converter support.
+- axios 1.7.4, follow-redirects 1.15.9.
+
+## 1.14.0 - 2024-01-23
+
+- Keep-alive connections (`keepAlive` option, on by default).
diff --git a/README.md b/README.md
index b44c924..b73b893 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # ConvertAPI Node.js Client
 
 [![npm version](https://badge.fury.io/js/convertapi.svg)](https://badge.fury.io/js/convertapi)
-[![Build Status](https://github.com/ConvertAPI/convertapi-node/actions/workflows/main.yml/badge.svg)](https://github.com/ConvertAPI/convertapi-node/actions)
+[![Build Status](https://github.com/ConvertAPI/convertapi-library-node/actions/workflows/build.yml/badge.svg)](https://github.com/ConvertAPI/convertapi-library-node/actions/workflows/build.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 
 ## Convert your files with our online file conversion API
@@ -152,12 +152,12 @@ var convertapi = require('../lib')(process.env.API_TOKEN, { baseUri: 'https://eu
 
 ### More examples
 
-Find more advanced examples in the [examples/](https://github.com/ConvertAPI/convertapi-node/tree/master/examples) folder.
+Find more advanced examples in the [examples/](https://github.com/ConvertAPI/convertapi-library-node/tree/main/examples) folder.
 
 ## Development Commands
 
 - `npm run clean` - Remove the `lib/` directory
-- `npm test` - Run tests with linting and coverage results.
+- `npm test` - Run tests with linting and coverage results. The tests call the API: set `CONVERT_API_SECRET` to your API token, and `CONVERT_API_BASE_URI` to use another API host.
 - `npm run test:only` - Run tests without linting or coverage.
 - `npm run test:watch` - You can even re-run tests on file changes!
 - `npm run test:prod` - Run tests with minified code.
@@ -165,11 +165,12 @@ Find more advanced examples in the [examples/](https://github.com/ConvertAPI/con
 - `npm run lint` - Run ESlint with airbnb-config
 - `npm run cover` - Get coverage report for your code.
 - `npm run build` - Babel will transpile ES6 => ES5 and minify the code.
-- `npm run prepublish` - Hook for npm. Do all the checks before publishing your module.
+
+Releases are published to npm by GitHub Actions, see [RELEASING.md](RELEASING.md).
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/ConvertAPI/convertapi-node. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
+Bug reports and pull requests are welcome on GitHub at https://github.com/ConvertAPI/convertapi-library-node. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.
 
 ## License
 
diff --git a/RELEASING.md b/RELEASING.md
new file mode 100644
index 0000000..d725f8a
--- /dev/null
+++ b/RELEASING.md
@@ -0,0 +1,47 @@
+# Releasing
+
+`main` is the only long-lived branch. Changes reach it through pull requests, merge commits only, and
+every pull request and push to `main` must pass the `build` check (`.github/workflows/build.yml`: lint,
+test and build on Node.js 20, 22 and 24, run the examples, audit the runtime dependencies, pack).
+Merging publishes nothing.
+
+The tests and the examples convert real files against the staging API (`https://stag-v2.convertapi.com/`)
+with the `CONVERTAPI_STAGING_TOKEN` repository secret (also set as a Dependabot secret). Pull requests
+from forks get no secrets, so their build fails until an admin merges them after review.
+
+A release is a **GitHub Release** whose tag is the version, published by `tomasr78`:
+
+```bash
+gh release create v1.15.1 --repo ConvertAPI/convertapi-library-node --target main --title v1.15.1 --generate-notes
+```
+
+That runs `.github/workflows/publish.yml` in the `npm` environment, which:
+
+1. refuses a Release published or re-run by anyone else;
+2. checks the tag is SemVer (`v1.15.1`, `v1.16.0-beta.1`), that the GitHub pre-release tick matches
+   the version, that a stable version is a commit on `main`, and that npm has never had that version;
+3. audits the runtime dependencies (high or critical fails), runs the linter and the tests, sets
+   `package.json` to the tag's version (`npm version --no-git-tag-version`) and builds `lib/`;
+4. publishes the packed tarball to npm with `--provenance`, under the dist-tag `latest` (stable),
+   `next` (pre-release) or `maintenance` (a stable version below the current `latest`), and waits until
+   npm serves it.
+
+It authenticates with npm **Trusted Publishing** (OIDC, no stored token) once the repository variable
+`NPM_TRUSTED_PUBLISHING` is `true`; until then it uses the `NPM_TOKEN` secret. The trusted publisher on
+npmjs.com is: organization or user `ConvertAPI`, repository `convertapi-library-node`, workflow
+`publish.yml`, environment `npm`.
+
+**Pre-releases** work the same way and may come from any branch:
+
+```bash
+gh release create v1.16.0-beta.1 --repo ConvertAPI/convertapi-library-node --target my-branch --prerelease --title v1.16.0-beta.1 --notes "Preview of ..."
+```
+
+They install with `npm install convertapi@next`.
+
+npm versions are permanent. A bad version can only be deprecated (`npm deprecate convertapi@1.15.1 "..."`)
+and fixed by releasing the next version. Never delete and re-create a release tag.
+
+The version in `package.json` is a `0.0.0-local` placeholder, and `npm publish` from a working copy is
+refused. Pull request builds pack `0.0.0-ci.{run}.g{sha}` as a downloadable artifact so a change can be
+tried before it is released. Update `CHANGELOG.md` in the pull request that changes behaviour.
diff --git a/examples/create_pdf_thumbnail.js b/examples/create_pdf_thumbnail.js
index 526c986..25529ab 100644
--- a/examples/create_pdf_thumbnail.js
+++ b/examples/create_pdf_thumbnail.js
@@ -3,21 +3,14 @@
 // set your api token
 var convertapi = require('../lib')(process.env.API_TOKEN);
 
-// Example of extracting first page from PDF and then chaining conversion PDF page to JPG.
-// https://www.convertapi.com/pdf-to-extract
+// Example of converting the first page of a PDF to a JPG thumbnail.
 // https://www.convertapi.com/pdf-to-jpg
 
 var dir = require('os').tmpdir();
 
-var pdfResultPromise = convertapi.convert('extract', {
-  File: './examples/files/test.pdf',
-  PageRange: 1
-});
-
 convertapi.convert('jpg', {
-    File: pdfResultPromise,
-    ScaleImage: true,
-    ScaleProportions: true,
+    File: './examples/files/test.pdf',
+    PageRange: 1,
     ImageHeight: 300,
     ImageWidth: 300
   })
diff --git a/package-lock.json b/package-lock.json
index 1f348f1..f3e309b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,15 +1,15 @@
 {
   "name": "convertapi",
-  "version": "1.14.0",
+  "version": "0.0.0-local",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "convertapi",
-      "version": "1.14.0",
+      "version": "0.0.0-local",
       "license": "MIT",
       "dependencies": {
-        "axios": "^1.6.2"
+        "axios": "^1.20.0"
       },
       "devDependencies": {
         "babel-cli": "^6.26.0",
@@ -406,6 +406,41 @@
         "node": ">=0.4.0"
       }
     },
+    "node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/agent-base/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/agent-base/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
     "node_modules/ajv": {
       "version": "5.5.2",
       "resolved": "https://registry.npmjs.org/ajv/-/ajv-5.5.2.tgz",
@@ -633,7 +668,8 @@
     "node_modules/asynckit": {
       "version": "0.4.0",
       "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "license": "MIT"
     },
     "node_modules/atob": {
       "version": "2.1.2",
@@ -649,13 +685,15 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.7.4",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.7.4.tgz",
-      "integrity": "sha512-DukmaFRnY6AzAALSH4J2M3k6PkaC+MfaAGdEERRWcC9q3/TWQwLpHR8ZRLKTdQ3aBDL64EdluRDjJqKw+BPZEw==",
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz",
+      "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==",
+      "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.6",
-        "form-data": "^4.0.0",
-        "proxy-from-env": "^1.1.0"
+        "follow-redirects": "^1.16.0",
+        "form-data": "^4.0.6",
+        "https-proxy-agent": "^5.0.1",
+        "proxy-from-env": "^2.1.0"
       }
     },
     "node_modules/axobject-query": {
@@ -1793,6 +1831,19 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/call-me-maybe": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/call-me-maybe/-/call-me-maybe-1.0.2.tgz",
@@ -2131,6 +2182,7 @@
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
       "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "license": "MIT",
       "dependencies": {
         "delayed-stream": "~1.0.0"
       },
@@ -2359,6 +2411,7 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
       "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "license": "MIT",
       "engines": {
         "node": ">=0.4.0"
       }
@@ -2396,6 +2449,20 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/electron-to-chromium": {
       "version": "1.4.609",
       "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.609.tgz",
@@ -2434,6 +2501,51 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/es-set-tostringtag": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+      "license": "MIT",
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.6",
+        "has-tostringtag": "^1.0.2",
+        "hasown": "^2.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/es-to-primitive": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.2.0.tgz",
@@ -3090,15 +3202,16 @@
       }
     },
     "node_modules/follow-redirects": {
-      "version": "1.15.9",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.9.tgz",
-      "integrity": "sha512-gew4GsXizNgdoRyqmyfMHyAmXsZDk6mHkSxZFCzW9gwlbtOW44CDtYavM+y+72qD/Vq2l550kMF52DT8fOLJqQ==",
+      "version": "1.16.1",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz",
+      "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==",
       "funding": [
         {
           "type": "individual",
           "url": "https://github.com/sponsors/RubenVerborgh"
         }
       ],
+      "license": "MIT",
       "engines": {
         "node": ">=4.0"
       },
@@ -3132,13 +3245,16 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
-      "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
+      "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
-        "mime-types": "^2.1.12"
+        "es-set-tostringtag": "^2.1.0",
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
@@ -3192,7 +3308,6 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
       "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
-      "dev": true,
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
       }
@@ -3221,6 +3336,43 @@
         "node": "*"
       }
     },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "license": "MIT",
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/get-value": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/get-value/-/get-value-2.0.6.tgz",
@@ -3290,6 +3442,18 @@
         "node": ">=4"
       }
     },
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/graceful-fs": {
       "version": "4.2.2",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.2.tgz",
@@ -3360,12 +3524,30 @@
       }
     },
     "node_modules/has-symbols": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.0.tgz",
-      "integrity": "sha1-uhqPGvKg/DllD1yFA2dwQSIGO0Q= sha512-QfcgWpH8qn5qhNMg3wfXf2FD/rSA4TwNiDDthKqXe7v6oBW0YKWcnfwMAApgWq9Lh+Yu+fQWVhHPohlD/S6uoQ==",
-      "dev": true,
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-tostringtag": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
+      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+      "license": "MIT",
+      "dependencies": {
+        "has-symbols": "^1.0.3"
+      },
       "engines": {
         "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
     "node_modules/has-value": {
@@ -3447,11 +3629,10 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.0.tgz",
-      "integrity": "sha512-vUptKVTpIJhcczKBbgnS+RtcuYMB8+oNzPK2/Hp3hanz8JmpATdmmgLgSaadVREkDm+e2giHwY3ZRkyjSIDDFA==",
-      "dev": true,
-      "optional": true,
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
       },
@@ -3487,6 +3668,42 @@
       "integrity": "sha512-pzXIvANXEFrc5oFFXRMkbLPQ2rXRoDERwDLyrcUxGhaZhgP54BBSl9Oheh7Vv0T090cszWBxPjkQQ5Sq1PbBRQ==",
       "dev": true
     },
+    "node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/https-proxy-agent/node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/https-proxy-agent/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "license": "MIT"
+    },
     "node_modules/iconv-lite": {
       "version": "0.4.24",
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
@@ -4353,6 +4570,15 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
     "node_modules/math-random": {
       "version": "1.0.4",
       "resolved": "https://registry.npmjs.org/math-random/-/math-random-1.0.4.tgz",
@@ -4389,6 +4615,7 @@
       "version": "1.52.0",
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
       "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
@@ -4397,6 +4624,7 @@
       "version": "2.1.35",
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
       "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "license": "MIT",
       "dependencies": {
         "mime-db": "1.52.0"
       },
@@ -5497,9 +5725,13 @@
       }
     },
     "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg=="
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
     },
     "node_modules/pseudomap": {
       "version": "1.0.2",
diff --git a/package.json b/package.json
index 7def2fd..b6cc49c 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "convertapi",
-  "version": "1.15.0",
+  "version": "0.0.0-local",
   "description": "Official convertapi.com API client",
   "main": "./lib/index.js",
   "types": "./index.d.ts",
@@ -14,7 +14,7 @@
     "cover": "istanbul cover _mocha -- --require babel-core/register --require babel-polyfill --recursive --timeout 15000",
     "lint": "eslint src test",
     "build": "cross-env BABEL_ENV=production babel src --out-dir lib",
-    "prepublish": "npm run clean && npm run lint && npm run test && npm run build"
+    "prepublishOnly": "echo 'convertapi is published by a GitHub Release, see RELEASING.md' && exit 1"
   },
   "files": [
     "lib",
@@ -23,7 +23,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/ConvertAPI/convertapi-node.git"
+    "url": "git+https://github.com/ConvertAPI/convertapi-library-node.git"
   },
   "keywords": [
     "convert",
@@ -37,11 +37,11 @@
   "author": "Tomas Rutkauskas <support@convertapi.com>",
   "license": "MIT",
   "bugs": {
-    "url": "https://github.com/ConvertAPI/convertapi-node/issues"
+    "url": "https://github.com/ConvertAPI/convertapi-library-node/issues"
   },
-  "homepage": "https://github.com/ConvertAPI/convertapi-node#readme",
+  "homepage": "https://github.com/ConvertAPI/convertapi-library-node#readme",
   "dependencies": {
-    "axios": "^1.6.2"
+    "axios": "^1.20.0"
   },
   "devDependencies": {
     "babel-cli": "^6.26.0",
diff --git a/test/index.js b/test/index.js
index 0539d71..a452ba2 100644
--- a/test/index.js
+++ b/test/index.js
@@ -6,7 +6,9 @@ chai.use(require('chai-as-promised'));
 chai.use(require('chai-fs'));
 
 const expect = chai.expect;
-const api = new ConvertAPI(process.env.CONVERT_API_SECRET);
+// CONVERT_API_BASE_URI points the tests at another API host (CI uses staging); unset means the default.
+const baseUri = process.env.CONVERT_API_BASE_URI;
+const api = new ConvertAPI(process.env.CONVERT_API_SECRET, { baseUri });
 
 describe('ConvertAPI', () => {
   it('should be accessible as function', () => {
@@ -132,7 +134,7 @@ describe('ConvertAPI', () => {
   });
 
   it('should handle client errors', () => {
-    const fastApi = new ConvertAPI(process.env.CONVERT_API_SECRET, { uploadTimeout: 0.0001 });
+    const fastApi = new ConvertAPI(process.env.CONVERT_API_SECRET, { baseUri, uploadTimeout: 0.0001 });
 
     const params = { File: './examples/files/test.docx' };