Resolve security advisories

.changeset/secure-node22-tsdown.md

@@ -0,0 +1,5 @@
+---
+'react-abode': minor
+---
+
+Require Node.js >= 22 (Node 20 is end-of-life). Build with tsdown instead of tsup (output file names are unchanged; an additional `dist/index.d.mts` is emitted) and resolve the form-data security advisory in dev dependencies.

.github/workflows/main.yml

@@ -2,7 +2,11 @@ name: CI
 on: [push]
 jobs:
   build:
+    name: Build and test on Node ${{ matrix.node }}
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: ['22', '24', '26']
 
     steps:
       - name: Begin CI...
@@ -12,10 +16,10 @@ jobs:
         name: Install pnpm
         id: pnpm-install
 
-      - name: Use Node 20
+      - name: Use Node ${{ matrix.node }}
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
+          node-version: ${{ matrix.node }}
           cache: 'pnpm'
 
       - name: Install dependencies
@@ -30,7 +34,6 @@ jobs:
 
       - name: Test
         run: pnpm test
-        continue-on-error: true
         env:
           CI: true
 

.github/workflows/publish.yml

@@ -2,18 +2,26 @@ name: Publish
 on:
   release:
     types: [created, edited]
+permissions:
+  contents: read
 jobs:
   build:
     runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: read
+      id-token: write # npm trusted publishing (OIDC)
     steps:
       - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         name: Install pnpm
         id: pnpm-install
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
+          node-version: '24'
+          package-manager-cache: false
       - name: Install dependencies
         run: pnpm install
         env:
@@ -22,6 +30,8 @@ jobs:
         run: pnpm build
         env:
           CI: true
+      - name: Upgrade npm for trusted publishing
+        run: npm i -g npm@^11.6.4
       - run: npm publish
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true

package.json

@@ -3,29 +3,28 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/labd/react-abode"
+    "url": "git+https://github.com/labd/react-abode.git"
   },
-  "packageManager": "pnpm@9.7.0",
+  "packageManager": "pnpm@12.12.0",
   "main": "dist/index.js",
   "typings": "dist/index.d.ts",
   "files": [
     "dist"
   ],
   "engines": {
-    "node": ">=16.0.0",
-    "pnpm": ">=7.5.2"
+    "node": ">=22.0.0",
+    "pnpm": ">=12"
   },
   "scripts": {
-    "start": "tsup ./src/index.ts --dts --watch",
-    "build": "tsup ./src/index.ts --dts --sourcemap --format esm,cjs",
+    "start": "tsdown --watch",
+    "build": "tsdown",
     "changeset": "pnpm exec changeset",
     "get:changes": "git log --format=%B --no-merges HEAD  ^master | pbcopy",
     "husky:install": "pnpm exec husky install",
     "lint": "eslint --ext .ts,.tsx src",
-    "test": "jest",
-    "test:watch": "jest --watch",
-    "prepare": "pnpm build",
-    "preinstall": "npx only-allow pnpm"
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepare": "pnpm build"
   },
   "prettier": {
     "printWidth": 80,
@@ -38,7 +37,6 @@
   "module": "dist/index.mjs",
   "devDependencies": {
     "@changesets/cli": "^2.24.2",
-    "@types/jest": "^28.1.6",
     "@types/jsdom": "^20.0.0",
     "@types/react": "^18.0.15",
     "@types/react-dom": "^18.0.6",
@@ -47,26 +45,26 @@
     "eslint": "^8.21.0",
     "fast-check": "^3.1.1",
     "husky": "^8.0.1",
-    "jest": "^28.1.3",
-    "jest-environment-jsdom": "^28.1.3",
+    "jsdom": "^30.1.3",
     "mutationobserver-shim": "^0.3.7",
     "prettier": "^2.7.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
-    "ts-jest": "^28.0.7",
     "ts-node": "^10.9.1",
+    "tsdown": "^0.23.1",
     "tslib": "^2.0.0",
-    "tsup": "^6.2.2",
-    "typescript": "^4.7.4"
+    "typescript": "^5.9.3",
+    "vitest": "^5.0.5"
   },
   "peerDependencies": {
     "react": ">=18",
     "react-dom": ">=18"
   },
-  "resolutions": {
-    "serialize-javascript": "^3.1.0"
-  },
   "dependencies": {
     "tiny-current-script": "^1.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
   }
 }