feat: add node 26 tests and update ci versions

.github/dependabot.yml

@@ -10,3 +10,7 @@ updates:
   - dependency-name: auto
     versions:
     - 10.20.1
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly

.github/workflows/nodejs.yml

@@ -2,34 +2,37 @@ name: Node CI
 
 on: [push]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # Never cancel a run on master: it could interrupt a release mid-publish.
+  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+
 jobs:
   tests:
     runs-on: ubuntu-latest
 
     strategy:
+      fail-fast: false
       matrix:
-        node-version: [22.x, 24.x]
+        node-version: [22.x, 24.x, 26.x]
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
+        uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 10
+      - uses: pnpm/action-setup@v6
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
           cache: "pnpm"
 
       - name: Install dependencies
-        run: pnpm install
-        env:
-          CI: "true"
+        run: pnpm install --frozen-lockfile
 
       - name: Build
         run: pnpm build
@@ -48,18 +51,16 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with: { fetch-depth: 0 }
 
-      - uses: pnpm/action-setup@v4
-        with:
-          version: 12
+      - uses: pnpm/action-setup@v6
 
+      # No dependency cache here, to avoid cache poisoning in the publish job
       - name: Use Node.js 24
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: 24
-          cache: "pnpm"
 
       - name: Create Release
         env:

.github/workflows/pkg-pr-new.yml

@@ -6,24 +6,25 @@ on:
   pull_request_review:
     types: [submitted]
 
+permissions:
+  contents: read
+
 jobs:
   deploy-preview:
     name: Deploy to pkg.pr.new
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: pnpm/action-setup@v3
-        with:
-          version: 10
+      - uses: pnpm/action-setup@v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: 24
           cache: pnpm
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Build package
         run: pnpm build
@@ -34,6 +35,6 @@ jobs:
           echo "::notice title=Install (PR)::pnpm add https://pkg.pr.new/react-use-disclosure@${{ github.event.pull_request.number }}"
           echo "::notice title=Install (SHA)::pnpm add https://pkg.pr.new/react-use-disclosure@${{ github.event.pull_request.head.sha }}"
           echo "::notice title=Version::0.0.0-preview.${{ github.event.pull_request.head.sha }}"
-        working-directory: .
+
       - name: Publish to pkg.pr.new
-        run: pnpx pkg-pr-new publish --compact '.' --no-template --packageManager=pnpm --pnpm
+        run: pnpm dlx pkg-pr-new publish --compact '.' --no-template --packageManager=pnpm --pnpm

package.json

@@ -13,6 +13,7 @@
   },
   "type": "module",
   "license": "MIT",
+  "packageManager": "pnpm@12.14.0",
   "files": [
     "index.*",
     "dist/"