v2.1.0

Parity with the tooling used by the most-starred TypeScript library monorepos, plus a security fix for the release workflow.

Security

• The release workflow could run code from a fork with write access (#11). It triggered on workflow_run for CI runs on a branch named main. GitHub matches that name against the branch the run came from, so a fork's PR from its own main branch qualified. Templates v1.1.0 through v2.0.0 then checked out the fork's commit and ran its install scripts in jobs holding write tokens, and in the publish job, npm publishing credentials. Release now runs only as the last job of CI, on pushes to main. v1.0.0 also fired for fork PRs, but it checked out main, so it never ran fork code.

Added

• Published packages support Node.js 24 and later (#9). The tests run on Node 24 and 26, on Linux, macOS and Windows. Development stays on the pinned Node 26.12.1.
• Preview packages for every PR (#14). pkg.pr.new publishes each package per commit and comments the install commands. It's off until the PKG_PR_NEW repository variable is set, and fork PRs never run it.
• Workflow security audit (#12). zizmor checks every workflow on every PR and fails on any finding.
• Unused code checks (#13). knip fails on unused files, exports and dependencies, and on undeclared dependencies.
• Repository health files (#10): issue forms, a PR template, SECURITY.md (private vulnerability reporting) and .editorconfig.

Changed

• npm publishing is gated by the NPM_PUBLISH repository variable. Packages are no longer marked "private": true, because previews skip private packages.
• The npm trusted publisher names ci.yml, not release.yml: npm checks the calling workflow.
• CI on a PR cancels the PR's older run when a new push arrives.

Changes for existing projects

1. Security (projects from v1.0.0 to v2.0.0): in release.yml, replace the workflow_run trigger with workflow_call: and remove the ref: ${{ github.event.workflow_run.head_sha ... }} lines. Gate select-mode on github.ref == 'refs/heads/main'. In ci.yml, add the release job: needs on every other job, if: github.event_name == 'push' && github.ref == 'refs/heads/main', the three write permissions, and uses: ./.github/workflows/release.yml. If you have a trusted publisher on npmjs.com, change its workflow file to ci.yml.
2. If you publish to npm today, set the repository variable NPM_PUBLISH to true when you take step 1's release.yml. The pack job now requires it, and without it releases stop.
3. Node 24 support:
   • Set engines.node to >=24 in Node packages.
   • In the root tsconfig.json, extend @tsconfig/node24.
   • Use @types/node 24.x in packages, and add the two Renovate @types/node rules.
   • Replace rm -rf dist and chmod +x with the node -e forms.
   • Add the compat job.
4. zizmor: add the workflows job with ZIZMOR_VERSION, and customManagers:githubActionsVersions to the Renovate extends. Make release need workflows.
5. knip: add knip 6.43.0, the check:unused script, the CI step and knip.json. Then fix what it reports, or add entries for false positives.
6. Previews (optional): install the pkg.pr.new GitHub App and set PKG_PR_NEW to true. Add pkg-pr-new 0.0.91 and the preview job. Keep "private": true only on packages that must never be previewed or published. Leave previews off in private repositories, because previews are public.
7. Health files: copy .github/ISSUE_TEMPLATE/, .github/PULL_REQUEST_TEMPLATE.md, SECURITY.md and .editorconfig. Then turn on Settings → Advanced Security → Private vulnerability reporting, and set the reply time in SECURITY.md.