@notionhq/client 5.23.0 on Node.js NPM

What's Changed

Webhook signature verification helpers (#722)
- Adds verifyWebhookSignature() (and signWebhookPayload() for tests) so you can confirm a webhook actually came from Notion instead of hand-rolling HMAC-SHA256.
- If you receive Notion webhooks: switch to this helper. Pass the raw request body (not re-serialized JSON) plus the X-Notion-Signature header. Works out of the box in Node 18+, Bun, Deno, Cloudflare Workers, Vercel Edge, and browsers.
iterateAllDataSourceRows / collectAllDataSourceRows helpers (#730, #731)
- A single dataSources.query caps out at ~10,000 rows and then silently stops — plain pagination misses the rest of a large data source. These helpers page past that cap by partitioning on created_time, de-duping rows automatically.
- If you query large data sources: use these instead of manual pagination to guarantee you see every row. (#731 also fixes window advancement for wiki data sources that return child data-source rows, not just pages.)
client.asyncTasks.retrieve (#736)
- Adds support for the newly documented async task endpoint, so you can poll long-running operations to completion.
allow_async on createPage and update-page-markdown (#728, #729)
- Lets these endpoints return an async task for large/slow writes instead of blocking the request.
- If you create pages or update markdown at scale: opt in with allow_async, then poll the returned task via client.asyncTasks.retrieve (#736).

Retry on service_overload (HTTP 529) (#727)
- The client now automatically retries 529s (respecting retry-after) alongside existing 429/500/503 handling — fewer transient failures surface to your code. No action needed; thanks @RyanBillard.

relevance search sort now uses the property discriminator (#724)
- Fixes the type for the relevance sort variant in search parameters. If you sort search results by relevance and hit a type error, this is the fix — align your call with the corrected shape.
Allow null for start_cursor in pagination types (#723)
- Pagination params now accept null (not just string/undefined), so you can pass a next_cursor straight through without a null-check dance.
Bump version to v5.23.0 (#741)