chore(deps): bump deps, clear advisories, automate releases

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: release-${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.CHANGESETS_GITHUB_TOKEN }}
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: '.node-version'
+          cache: pnpm
+          registry-url: https://registry.npmjs.org
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Create Release PR or Publish
+        uses: changesets/action@v1
+        with:
+          publish: pnpm release
+          version: pnpm version
+          commit: 'chore(release): version packages'
+          title: 'chore(release): version packages'
+        env:
+          GITHUB_TOKEN: ${{ secrets.CHANGESETS_GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: 'true'

CLAUDE.md

@@ -1,22 +1,38 @@
 # ts-referer-parser
 
-## Release Workflow (using changesets)
+## Release Workflow (automated via changesets)
+
+Releases are automated by `.github/workflows/release.yml` (modeled on start-toast).
+You no longer publish by hand.
 
 ```bash
-# 1. When making changes, add a changeset
+# 1. When making changes that affect the published package, add a changeset
 pnpm changeset
 # prompts: patch/minor/major? description of change?
 
-# 2. Commit the changeset file with your code
+# 2. Commit the changeset file with your code and open a PR
+```
+
+On merge to `main`, the Release workflow:
 
-# 3. When ready to release:
-pnpm version          # consumes changesets, bumps version, updates CHANGELOG
-git add -A && git commit -m "v1.x.x"
-git tag v1.x.x && git push --follow-tags
+- Collects pending changesets and opens (or updates) a **"chore(release): version
+  packages"** PR that bumps the version and updates `CHANGELOG.md`.
+- When **that** Release PR is merged, it builds and publishes to npm via
+  `pnpm release` (`changeset publish`).
 
-# 4. Publish
-pnpm release          # builds + publishes to npm
+So: **merge feature PR → merge the Release PR → published.** No manual `pnpm
+version` / `git tag` / `gh release` step.
 
-# 5. Create GitHub release
-gh release create v1.x.x --title "v1.x.x" --generate-notes
-```
+### Skip the changeset for dev-only changes
+
+Dependency bumps, CI/tooling, and other changes that don't affect the published
+`dist/` should **not** include a changeset — they shouldn't trigger a version bump
+or an npm release.
+
+### Required setup (one-time, on GitHub/npm — not in code)
+
+- **npm Trusted Publishing (OIDC)** configured for `ts-referer-parser`, pointed at
+  this repo's `release.yml`. The workflow uses `id-token: write` +
+  `NPM_CONFIG_PROVENANCE: true` and carries no npm token.
+- **`CHANGESETS_GITHUB_TOKEN`** secret (a PAT) so the auto-opened Release PR can
+  trigger the `PR Checks` workflow (the default `GITHUB_TOKEN` can't).

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.10/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
   "vcs": {
     "enabled": false,
     "clientKind": "git",
@@ -20,7 +20,7 @@
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "style": {
         "useConst": "off"
       }

package.json

@@ -48,14 +48,19 @@
     "url": "https://github.com/stevan-borus/ts-referer-parser.git"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.10",
-    "@changesets/changelog-github": "^0.6.0",
-    "@changesets/cli": "^2.30.0",
+    "@biomejs/biome": "^2.5.0",
+    "@changesets/changelog-github": "^0.7.0",
+    "@changesets/cli": "^2.31.0",
     "husky": "^9.1.7",
-    "tsdown": "^0.21.7",
-    "typescript": "^6.0.2",
-    "vite": "8.0.7",
-    "vitest": "^4.1.2"
+    "tsdown": "^0.22.2",
+    "typescript": "^6.0.3",
+    "vite": "8.0.16",
+    "vitest": "^4.1.9"
+  },
+  "pnpm": {
+    "overrides": {
+      "esbuild": "^0.28.1"
+    }
   },
   "packageManager": "pnpm@10.5.0+sha256.e77bc3c5a9888f823fe061413f60ef02afad4b967c9b16b13458279473ba7d1c"
 }