diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index a54cb89..c248d67 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -16,17 +16,17 @@ jobs:
     if: ${{ !contains(github.head_ref, 'all-contributors') }}
     strategy:
       matrix:
-        node: [12, 14, 16, 17]
+        node: [lts/-1, lts/*]
     runs-on: ubuntu-latest
     steps:
       - name: 🛑 Cancel Previous Runs
         uses: styfle/cancel-workflow-action@0.11.0
 
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: ⎔ Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node }}
 
@@ -44,6 +44,11 @@ jobs:
   release:
     needs: main
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      id-token: write # to enable use of OIDC for npm provenance
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
     if:
       ${{ github.repository == 'remark-embedder/transformer-codesandbox' &&
       contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/alpha',
@@ -53,12 +58,12 @@ jobs:
         uses: styfle/cancel-workflow-action@0.11.0
 
       - name: ⬇️ Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: ⎔ Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v6
         with:
-          node-version: 16
+          node-version: lts/*
 
       - name: 📥 Download deps
         uses: bahmutov/npm-install@v1
@@ -69,9 +74,9 @@ jobs:
         run: npm run build
 
       - name: 🚀 Release
-        uses: cycjimmy/semantic-release-action@v3
+        uses: cycjimmy/semantic-release-action@v5.0.2
         with:
-          semantic_version: 18
+          semantic_version: 25
           branches: |
             [
               '+([0-9])?(.{+([0-9]),x}).x',
@@ -83,4 +88,3 @@ jobs:
             ]
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/package.json b/package.json
index cc89782..d52b06a 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "kcd-scripts": "^12.2.0",
     "remark": "^14.0.2",
     "remark-html": "^15.0.1",
-    "typescript": "^4.7.4"
+    "typescript": "^5.9.3"
   },
   "peerDependencies": {
     "@remark-embedder/core": "^3.0.0"
diff --git a/src/__tests__/index.ts b/src/__tests__/index.ts
index f53eb3a..dd8262f 100644
--- a/src/__tests__/index.ts
+++ b/src/__tests__/index.ts
@@ -12,12 +12,14 @@ const unquoteSerializer = {
 expect.addSnapshotSerializer(unquoteSerializer)
 
 test('smoke test', async () => {
-  const result = await remark()
+  const processor = remark()
     .use(remarkEmbedder, {
       transformers: [CodeSandboxTransformer],
     })
+    // @ts-expect-error - Type inference issue with remark plugins
     .use(remarkHTML, {sanitize: false})
-    .process(
+  
+  const result = await processor.process(
       `
 This is a CodeSandbox:
 
diff --git a/src/index.ts b/src/index.ts
index 373683c..d95c9ce 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -1,4 +1,4 @@
-import type {Transformer} from '@remark-embedder/core'
+import {type Transformer} from '@remark-embedder/core'
 
 const transformer: Transformer = {
   getHTML: urlString => {