Updated dependencies - use pnpm 12

.github/workflows/node.js.yml

@@ -9,35 +9,45 @@ concurrency:
 env:
   HUSKY: 0
 
-permissions:
-  contents: read # for checkout
-
 jobs:
   ci:
     name: Continuous Integration
+    permissions:
+      contents: read # for checkout
+    strategy:
+      fail-fast: true
+      matrix:
+        node: [22, 24, 26]
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-      - name: Use Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Setup
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
-          node-version-file: '.node-version'
-          cache: 'pnpm'
+          cache: true
+          install: false # Audit before installing dependencies
+          runtime: node@${{ matrix.node }}
+
+      - name: Audit dependencies
+        run: pnpm audit --audit-level=moderate --prod
 
       - name: Installing dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
+
+      - name: Verify registry signatures for installed packages
+        run: pnpm audit signatures
 
       - name: Linting
         run: pnpm lint
 
       - name: Type checking
         run: pnpm typecheck
 
+      - name: Spell check
+        run: pnpm spellcheck
+
       - name: Testing
         run: pnpm coverage
 

.github/workflows/release.yml

@@ -10,9 +10,6 @@ concurrency: release
 env:
   HUSKY: 0
 
-permissions:
-  contents: read # for checkout
-
 jobs:
   release:
     name: Release
@@ -29,29 +26,23 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-      - name: Use Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - name: Setup
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
-          node-version-file: '.node-version'
-          cache: 'pnpm'
+          cache: true
+          install: false # Audit before installing dependencies
 
-      - name: Install latest npm
-        run: |
-          npm install -g npm@latest
-          npm --version
+      - name: Audit dependencies
+        run: pnpm audit --audit-level=moderate --prod
 
       - name: Installing dependencies
         run: pnpm install --frozen-lockfile
 
       - name: Building
-        run: pnpm run --if-present build
+        run: pnpm build
 
-      # https://github.com/pnpm/pnpm/issues/7909
-      # - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies
-      #   run: npm audit signatures
+      - name: Install npm for Trusted Publishing
+        run: pnpm add --global npm@latest
 
       - name: Release
         env:

package.json

@@ -17,7 +17,6 @@
     "url": "https://github.com/webdeveric/commitlint-plugin-cspell/issues"
   },
   "license": "MIT",
-  "packageManager": "pnpm@11.17.0+sha512.cca3cea332ad254bb84145f966d19f4879615210346fc92c79a047f23a0d7b3cca3c3792f0076ba1f1831d277efbcf0a9119b31a9a60eca7fb3d6231f331ef72",
   "sideEffects": false,
   "type": "module",
   "main": "./dist/index.js",
@@ -32,47 +31,61 @@
   "files": [
     "dist"
   ],
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": ">=12.0.0 <13.0.0",
+      "onFail": "warn"
+    },
+    "runtime": [
+      {
+        "name": "node",
+        "version": "^26.9.0",
+        "onFail": "download"
+      }
+    ]
+  },
   "scripts": {
-    "clean": "rimraf ./dist/",
+    "clean": "rimraf ./cache/ ./dist/",
     "prebuild": "pnpm clean",
     "build": "tsc --build tsconfig.mjs.json --force",
     "validate": "validate-package-exports --check --info",
     "postbuild": "pnpm validate",
     "typecheck": "tsc --build --verbose",
-    "lint": "eslint ./*.{js,cjs,mjs,ts,cts,mts} ./src/ ./test/ --ext .ts,.mjs,.cjs",
+    "lint": "eslint ./*.{js,cjs,mjs,ts,cts,mts} ./src/ ./test/ --ext .ts,.mjs,.cjs --no-error-on-unmatched-pattern",
     "test": "vitest",
     "coverage": "vitest run  -c vitest.config.mts --coverage",
-    "spellcheck": "cspell './{.github,src,test}/**/*.{ts,json}' './*.{js,json,md,mjs,mts}' './package.json' --no-progress",
+    "spellcheck": "cspell \"./{.github,src,test}/**/*.{ts,json}\" \"./*.{js,json,md,mjs,mts}\" \"./package.json\" --no-progress",
     "prepublishOnly": "pnpm typecheck && pnpm spellcheck && pnpm lint && pnpm coverage && pnpm build",
     "format": "prettier --write ./*.{js,json,md,mjs,mts} ./src/ ./test/",
     "prepare": "husky"
   },
   "prettier": "@webdeveric/prettier-config",
   "dependencies": {
     "@commitlint/types": "^21.2.0",
-    "cspell-lib": "^10.0.1"
+    "cspell-lib": "^10.3.3"
   },
   "devDependencies": {
-    "@commitlint/lint": "^21.2.0",
-    "@types/node": "^22.20.1",
+    "@commitlint/lint": "^21.2.2",
+    "@types/node": "^22.20.3",
     "@typescript/native": "npm:typescript@^7.0.2",
-    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/coverage-v8": "^5.0.1",
     "@webdeveric/eslint-config-ts": "^0.12.1",
     "@webdeveric/prettier-config": "^0.4.0",
     "conventional-changelog-conventionalcommits": "^9.3.1",
-    "cspell": "^10.0.1",
+    "cspell": "^10.3.3",
     "eslint": "^8.57.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import": "^2.32.0",
     "husky": "^9.1.7",
-    "lint-staged": "^17.1.1",
-    "prettier": "^3.9.6",
+    "lint-staged": "^17.5.1",
+    "prettier": "^3.9.7",
     "rimraf": "^6.1.3",
-    "semantic-release": "^25.0.8",
+    "semantic-release": "^25.0.9",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "validate-package-exports": "^1.3.3",
-    "vitest": "^4.1.10"
+    "validate-package-exports": "^1.4.5",
+    "vitest": "^5.0.1"
   },
   "peerDependencies": {
     "@commitlint/lint": ">=7.6.0"