[Justin Hammond (Justintime50)]

Description

Preps v9.0.0 (GA) for release, promoting v9.0.0-rc.1: bumps the version in package.json/package-lock.json and dates the CHANGELOG entry. Follows the v6.0.0 GA-after-RC precedent: the v9.0.0 entry lists the changes since rc.1 and points to the rc.1 entry (with its full breaking-changes list) and the Upgrade Guide.

See our Upgrade Guide for more details.

Includes all of the changes made in v9.0.0-rc.1 below plus the following:

• Adds surcharges property and model to Rate object

• Removes the deprecated, unusable addCreditCard function

  • Stripe has disabled the ability to pass plain credit card details over the wire and now requires using Stripe.js/Elements/Checkout. Follow the Decentralized (EasyPost-Manage Billing) Guide for more details on the new flow to use.
  • Makes referralCustomer.retrieveEasyPostStripeApiKey public to help facilitate adding credit cards using Stripe.js

• Adds support for FedexDefaultAccount, GofoWalletAccount, UpsDapAccount, UniUniWalletAccount, and VehoWalletAccount by properly routing carrier-account create requests to the /carrier_accounts/open endpoint.

• Also pins CI runners from ubuntu-latest to ubuntu-24.04: ubuntu-latest moved to Ubuntu 26.04, which dropped older language versions from our test matrix, so this keeps CI on 24.04 until a later modernization effort.

• Also runs npm update to refresh package-lock.json within existing semver ranges, clearing the dev-dependency advisories (vitest, body-parser, qs, markdown-it) that were failing the audit-ci scan.

Testing

Pull Request Type

Please select the option(s) that are relevant to this PR.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Improvement (fixing a typo, updating readme, renaming a variable name, etc)

Reviewer notes

• Draft PR ci: grant release job contents: write for asset upload (SEC-842) #596 (ci: grant release job contents: write for asset upload, SEC-842) is still open and may need to land before this release so the release workflow can upload assets.
• This is a major (GA) release: see the v9.0.0-rc.1 breaking changes and UPGRADE_GUIDE.md ("Upgrading from 8.x to 9.0"). The deprecated addCreditCard removal rides along with the major.