feat!: modernise to ESM, drop all runtime dependencies (#169)

BREAKING CHANGE: CJS require() no longer supported, use ESM import.
BufferList and BufferListStream must be called with new.
Switches from readable-stream to node:stream and buffer to node:buffer,
removing all runtime dependencies. Node.js >= 20 required.

Author: rvagg

.github/dependabot.yml

@@ -7,10 +7,14 @@ updates:
     commit-message:
       prefix: 'chore'
       include: 'scope'
+    cooldown:
+      default-days: 5
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
       interval: 'daily'
     commit-message:
       prefix: 'chore'
       include: 'scope'
+    cooldown:
+      default-days: 5

.github/workflows/test-and-release.yml

@@ -1,11 +1,12 @@
 name: Test & Maybe Release
 on: [push, pull_request]
+
 jobs:
   test:
     strategy:
       fail-fast: false
       matrix:
-        node: [18.x, 20.x, lts/*, current]
+        node: [lts/*, current]
         os: [macos-latest, ubuntu-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
@@ -16,17 +17,26 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
       - name: Install Dependencies
+        run: npm install --no-progress
+      - name: Check build is up to date
         run: |
-          npm install --no-progress
+          npm run build
+          git diff --exit-code || (echo "::error::Build artifacts not committed. Run 'npm run build' and commit the changes." && exit 1)
       - name: Run tests
         run: |
           npm config set script-shell bash
           npm run test:ci
+
   release:
     name: Release
     needs: test
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -36,26 +46,13 @@ jobs:
         uses: actions/setup-node@v6.3.0
         with:
           node-version: lts/*
+          registry-url: 'https://registry.npmjs.org'
       - name: Install dependencies
-        run: |
-          npm install --no-progress --no-package-lock --no-save
+        run: npm install --no-progress --no-package-lock --no-save
       - name: Build
-        run: |
-          npm run build
-      - name: Install plugins
-        run: |
-          npm install \
-            @semantic-release/commit-analyzer \
-            conventional-changelog-conventionalcommits \
-            @semantic-release/release-notes-generator \
-            @semantic-release/npm \
-            @semantic-release/github \
-            @semantic-release/git \
-            @semantic-release/changelog \
-            --no-progress --no-package-lock --no-save
+        run: npm run build
       - name: Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
         run: npx semantic-release
-

.gitignore

@@ -1 +1,3 @@
-node_modules/
+node_modules
+package-lock.jsontypes/tsconfig.tsbuildinfo
+package-lock.json