build(deps): fix vulnerable dev dependencies and modernize tooling

.changeset/config.json

@@ -1,11 +1,16 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@2.1.1/schema.json",
-  "changelog": "@changesets/cli/changelog",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.1/schema.json",
+  "changelog": [
+    "@changesets/changelog-github",
+    {
+      "repo": "labd/react-abode"
+    }
+  ],
   "commit": false,
   "fixed": [],
   "linked": [],
-  "access": "restricted",
+  "access": "public",
   "baseBranch": "master",
   "updateInternalDependencies": "patch",
   "ignore": []
-}
+}

.changeset/package-exports.md

@@ -0,0 +1,5 @@
+---
+'react-abode': minor
+---
+
+Add an `exports` map (ESM `dist/index.mjs` and CommonJS `dist/index.js`, each with its own type declarations), `"type": "commonjs"` and `"sideEffects": false`. Deep imports into `dist/` are no longer possible; import from `react-abode` instead.

.github/workflows/main.yml

@@ -1,43 +1,38 @@
 name: CI
-on: [push]
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+permissions:
+  contents: read
+
 jobs:
-  build:
-    name: Build and test on Node ${{ matrix.node }}
+  validate:
+    name: Validate on Node ${{ matrix.node }}
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
-        node: ['22', '24', '26']
-
+        node: ["22.x", "24.x", "26.x"]
     steps:
-      - name: Begin CI...
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
-
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
-        name: Install pnpm
-        id: pnpm-install
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - name: Use Node ${{ matrix.node }}
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - name: Install Node.js, pnpm and dependencies
+        uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0
         with:
           node-version: ${{ matrix.node }}
-          cache: 'pnpm'
-
-      - name: Install dependencies
-        run: pnpm install
-        env:
-          CI: true
 
-      - name: Lint (biome)
-        run: pnpm biome ci
-        env:
-          CI: true
+      - name: Check formatting, linting and types
+        run: pnpm check
 
       - name: Test
         run: pnpm test
-        env:
-          CI: true
 
       - name: Build
         run: pnpm build
-        env:
-          CI: true

.github/workflows/publish.yml

@@ -1,37 +1,44 @@
-name: Publish
+name: Release
+
 on:
-  release:
-    types: [created, edited]
+  push:
+    branches:
+      - master
+
 permissions:
   contents: read
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
 jobs:
-  build:
+  release:
+    name: Release
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     environment: release
     permissions:
-      contents: read
+      contents: write
+      pull-requests: write
       id-token: write # npm trusted publishing (OIDC)
     steps:
-      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
-        with:
-          persist-credentials: false
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
-        name: Install pnpm
-        id: pnpm-install
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Node.js, pnpm and dependencies
+        uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0
         with:
-          node-version: '24'
-          package-manager-cache: false
-      - name: Install dependencies
-        run: pnpm install
-        env:
-          CI: true
-      - name: Build
-        run: pnpm build
-        env:
-          CI: true
+          cache: "false"
+
       - name: Upgrade npm for trusted publishing
         run: npm i -g npm@^11.6.4
-      - run: npm publish
+
+      - name: Create release pull request or publish to npm
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
+        with:
+          pr-title: "Release new version"
+          commit-message: "chore: release new version"
+          version-script: pnpm publish:version
+          publish-script: pnpm publish:ci
+          push-with-git-cli: true
         env:
           NPM_CONFIG_PROVENANCE: true

.nvmrc

@@ -0,0 +1 @@
+24

README.md

@@ -1,5 +1,8 @@
 # React Abode
 
+[![npm](https://img.shields.io/npm/v/react-abode)](https://www.npmjs.com/package/react-abode)
+[![CI](https://github.com/labd/react-abode/actions/workflows/main.yml/badge.svg)](https://github.com/labd/react-abode/actions/workflows/main.yml)
+
 React Abode is a simple React micro-frontend framework allowing you to host multiple react components by defining HTML.
 
 ## Features

package.json

@@ -6,8 +6,24 @@
     "url": "git+https://github.com/labd/react-abode.git"
   },
   "packageManager": "pnpm@12.12.0",
-  "main": "dist/index.js",
-  "typings": "dist/index.d.ts",
+  "type": "commonjs",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist"
   ],
@@ -20,33 +36,35 @@
     "build": "tsdown",
     "changeset": "pnpm exec changeset",
     "get:changes": "git log --format=%B --no-merges HEAD  ^master | pbcopy",
-    "husky:install": "pnpm exec husky install",
+    "husky:install": "husky",
     "lint": "biome check",
     "test": "vitest run",
     "test:watch": "vitest",
     "prepare": "pnpm build",
     "format": "biome check --fix",
-    "check": "biome check && tsc --noEmit"
+    "check": "biome check && tsc --noEmit",
+    "typecheck": "tsc --noEmit",
+    "publish:ci": "pnpm build && pnpm changeset publish",
+    "publish:version": "pnpm changeset version && pnpm format"
   },
   "name": "react-abode",
   "author": "Bram Kaashoek",
-  "module": "dist/index.mjs",
   "devDependencies": {
     "@biomejs/biome": "2.5.15",
-    "@changesets/cli": "^2.24.2",
-    "@types/jsdom": "^20.0.0",
-    "@types/react": "^18.0.15",
-    "@types/react-dom": "^18.0.6",
-    "fast-check": "^3.1.1",
-    "husky": "^8.0.1",
+    "@changesets/changelog-github": "^1.0.1",
+    "@changesets/cli": "^3.0.3",
+    "@types/jsdom": "^30.0.0",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "fast-check": "^4.10.2",
+    "husky": "^9.1.7",
     "jsdom": "^30.1.3",
     "mutationobserver-shim": "^0.3.7",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0",
-    "ts-node": "^10.9.1",
+    "publint": "^0.3.25",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
     "tsdown": "^0.23.1",
-    "tslib": "^2.0.0",
-    "typescript": "^5.9.3",
+    "typescript": "^7.0.2",
     "vitest": "^5.0.5"
   },
   "peerDependencies": {