chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in the dev-dependencies group across 1 directory

.github/workflows/build-release-changelog.yml

@@ -9,16 +9,16 @@ on:
 
 jobs:
 
-  create-release:
+  publish-npm:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
@@ -30,9 +30,18 @@ jobs:
         run: npm install -g npm@^11.5
       - name: Publish package on NPM 📦
         run: npm publish
+
+  github-release:
+    needs: publish-npm
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build Changelog
         id: build_changelog
-        uses: mikepenz/release-changelog-builder-action@32e3c96f29a6532607f638797455e9e98cfc703d # v4.2.2
+        uses: mikepenz/release-changelog-builder-action@cb021f9b36a51a7c6f18e4679b6fa2cb77a1260c # v6.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+permissions: {}
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24'
+          cache: npm
+      - name: Install dependencies
+        run: npm ci --ignore-scripts
+      - name: Lint
+        run: npx eslint .
+      - name: Build 🔧
+        run: npm run build

SECURITY.md

@@ -0,0 +1,42 @@
+# Security Policy
+
+## Supported versions
+
+Squirrel Select is pre-1.0. Only the latest published release receives security fixes;
+there are no maintained backport branches.
+
+| Version | Supported |
+| :-- | :-- |
+| 0.1.x | yes |
+| < 0.1 | no |
+
+## Reporting a vulnerability
+
+Report privately through GitHub Security Advisories:
+https://github.com/3m5/squirrel-select/security/advisories/new
+
+Do not open a public issue, pull request or discussion for a suspected vulnerability —
+that is the disclosure.
+
+Please include:
+
+- affected version and how the library is loaded (npm package, bundled `dist/`)
+- a minimal reproduction, ideally the `<select>` markup and attributes involved
+- impact you believe it has
+
+## What to expect
+
+- acknowledgement within 5 working days
+- an assessment with a fix or a rejection, and the reason, within 30 days
+- credit in the advisory and the release notes, unless you ask to stay anonymous
+
+Fixes are published as a new release, and the advisory is made public once that release
+is available on npm.
+
+## Scope
+
+Squirrel Select runs entirely in the browser and renders the content of an existing
+`<select>` element. Markup and option values already under an attacker's control before
+the library initializes are out of scope — it reflects the DOM it is given. In scope is
+anything where Squirrel Select turns that input into script execution, escapes the
+element it was applied to, or breaks the selector escaping it performs internally.