chore: restore npm publishing via OIDC, update toolchain

.changeset/olive-donkeys-shave.md

@@ -0,0 +1,5 @@
+---
+"cloudflared": patch
+---
+
+Fix `CLOUDFLARED_VERSION` being ignored during installation. The `postinstall` script hardcoded `bin install latest`, so the environment variable documented in the README had no effect on the version that got installed. Installing an explicit version also printed `Installing cloudflared undefined` because the message read the raw argument instead of the resolved version.

.changeset/quiet-pumas-repeat.md

@@ -0,0 +1,5 @@
+---
+"cloudflared": patch
+---
+
+Update the toolchain and CI. Publishing now uses npm trusted publishing (OIDC) instead of a long-lived `NPM_TOKEN`, which npm revoked along with all classic tokens. pnpm moves to 11 for its native OIDC support, so its settings move from `package.json` to `pnpm-workspace.yaml`. Also bumps eslint, vitest, prettier, typedoc and `@types/node`, drops the unused `changeset` package (an unrelated LevelDB utility, not the changesets CLI), moves typedoc to a config file so the `@platform` tag no longer warns, upgrades the GitHub Actions to Node 24 runtimes, and refreshes the cloudflared test matrix.

.github/workflows/docs.yml

@@ -10,13 +10,15 @@ jobs:
     docs:
         name: docs
         runs-on: ubuntu-latest
+        permissions:
+            contents: write
 
         steps:
             - name: Checkout Repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v7
 
             - name: Setup PNPM
-              uses: pnpm/action-setup@v4
+              uses: pnpm/action-setup@v6
               with:
                   run_install: true
 
@@ -26,5 +28,5 @@ jobs:
             - name: Deploy
               uses: peaceiris/actions-gh-pages@v4
               with:
-                  github_token: ${{ secrets.GITHUB_TOKEN  }}
+                  github_token: ${{ secrets.GITHUB_TOKEN }}
                   publish_dir: "./docs"

.github/workflows/release.yml

@@ -15,12 +15,15 @@ jobs:
             contents: write
             issues: write
             pull-requests: write
+            # Lets npm mint a short-lived OIDC token instead of using a long-lived
+            # NPM_TOKEN. Requires a Trusted Publisher pointing at this workflow file.
+            id-token: write
         steps:
             - name: Checkout Repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v7
 
             - name: Setup PNPM
-              uses: pnpm/action-setup@v4
+              uses: pnpm/action-setup@v6
               with:
                   run_install: true
 
@@ -36,5 +39,6 @@ jobs:
                   title: Release Packages
                   commit: bump versions
               env:
+                  # No NPM_TOKEN on purpose: changesets/action writes an .npmrc when it
+                  # sees one, and that credential would take precedence over OIDC.
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-                  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/test.yml

@@ -20,10 +20,10 @@ jobs:
                     - macos-latest
                 version:
                     - "latest"
-                    - "2026.1.2"
+                    - "2026.7.3"
+                    - "2026.5.0"
+                    - "2026.2.0"
                     - "2025.11.1"
-                    - "2025.9.1"
-                    - "2025.7.0"
 
         name: "${{ matrix.os }} - ${{ matrix.version }}"
         runs-on: ${{ matrix.os }}
@@ -35,18 +35,19 @@ jobs:
 
         steps:
             - name: Checkout Repository
-              uses: actions/checkout@v4
+              uses: actions/checkout@v7
 
             - name: Setup PNPM
-              uses: pnpm/action-setup@v4
+              id: pnpm
+              uses: pnpm/action-setup@v6
               with:
                   run_install: true
 
             - name: Build
               run: pnpm build
 
             - name: Test (w/ service)
-              run: sudo -E $PNPM_HOME/pnpm test
+              run: sudo -E ${{ steps.pnpm.outputs.bin_dest }}/pnpm test
               if: matrix.os != 'windows-latest'
 
             - name: Test (w/o service)

.prettierignore

@@ -0,0 +1 @@
+pnpm-lock.yaml

README.md

@@ -75,7 +75,7 @@ spawn(bin, ["--version"], { stdio: "inherit" });
 
 ### Tunnel
 
-Checkout [`examples/tunnel.js`](examples/tunnel.js).
+Checkout [`examples/tunnel.mjs`](examples/tunnel.mjs) (or [`examples/tunnel.js`](examples/tunnel.js) for CommonJS).
 
 `Tunnel` is inherited from `EventEmitter`, so you can listen to the events it emits, checkout [`examples/events.mjs`](examples/events.mjs).
 
@@ -107,7 +107,7 @@ async function main() {
 ```
 
 ```sh
-❯ node examples/tunnel.js
+❯ node examples/tunnel.mjs
 Cloudflared Tunnel Example.
 LINK: https://mailto-davis-wilderness-facts.trycloudflare.com
 CONN: {
@@ -120,7 +120,7 @@ tunnel process exited with code 0
 
 ### Service
 
-Checkout [`examples/service.js`](examples/service.js).
+Checkout [`examples/service.mjs`](examples/service.mjs) (or [`examples/service.js`](examples/service.js) for CommonJS).
 
 ```js
 import { service } from "cloudflared";
@@ -143,7 +143,7 @@ async function main() {
 ```
 
 ```sh
-❯ node examples/service.js
+❯ node examples/service.mjs
 Cloudflared Service Example.
 Service is running.
   - http://localhost:12345 -> sub.example.com

eslint.config.mjs

@@ -15,14 +15,7 @@ const compat = new FlatCompat({
 
 export default [
     {
-        ignores: [
-            "**/node_modules",
-            "**/lib",
-            "**/docs",
-            "**/.eslintrc.js",
-            "**/jest.config.cjs",
-            "**/examples",
-        ],
+        ignores: ["**/node_modules", "**/lib", "**/docs", "**/examples"],
     },
     ...compat.extends("eslint:recommended", "plugin:@typescript-eslint/recommended", "prettier"),
     {
@@ -41,7 +34,7 @@ export default [
                     allowArgumentsExplicitlyTypedAsAny: true,
                 },
             ],
-            "@typescript-eslint/no-unused-expressions": "warn",
+            "@typescript-eslint/no-unused-expressions": "error",
         },
     },
 ];

package.json

@@ -9,10 +9,10 @@
         "test": "vitest",
         "dev": "tsup --watch",
         "build": "tsup",
-        "docs": "typedoc ./src/lib.ts",
-        "format": "prettier --write '**/*.{js,ts,jsx,tsx,json,yml,yaml,md,html}' --ignore-path .gitignore",
+        "docs": "typedoc",
+        "format": "prettier --write '**/*.{js,ts,jsx,tsx,json,yml,yaml,md,html}' --ignore-path .gitignore --ignore-path .prettierignore",
         "lint": "eslint .",
-        "postinstall": "node scripts/postinstall.mjs && node lib/cloudflared.js bin install latest",
+        "postinstall": "node scripts/postinstall.mjs && node lib/cloudflared.js bin install",
         "changeset": "changeset"
     },
     "keywords": [
@@ -31,22 +31,21 @@
         "scripts"
     ],
     "devDependencies": {
-        "@changesets/changelog-github": "^0.6.0",
-        "@changesets/cli": "^2.31.0",
-        "@eslint/eslintrc": "^3.3.5",
+        "@changesets/changelog-github": "^0.7.0",
+        "@changesets/cli": "^2.31.1",
+        "@eslint/eslintrc": "^3.3.6",
         "@eslint/js": "^10.0.1",
-        "@types/node": "^25.6.0",
-        "@typescript-eslint/eslint-plugin": "^8.59.1",
-        "@typescript-eslint/parser": "^8.59.1",
-        "changeset": "^0.2.6",
+        "@types/node": "^26.2.0",
+        "@typescript-eslint/eslint-plugin": "~8.66.0",
+        "@typescript-eslint/parser": "~8.66.0",
         "cloudflared": "workspace:*",
-        "eslint": "^10.2.1",
+        "eslint": "^10.8.1",
         "eslint-config-prettier": "^10.1.8",
-        "prettier": "^3.8.3",
+        "prettier": "^3.9.6",
         "tsup": "^8.5.1",
-        "typedoc": "^0.28.19",
+        "typedoc": "^0.28.20",
         "typescript": "^6.0.3",
-        "vitest": "^4.1.5"
+        "vitest": "^4.1.10"
     },
     "homepage": "https://github.com/JacobLinCool/node-cloudflared#readme",
     "repository": {
@@ -56,10 +55,5 @@
     "bugs": {
         "url": "https://github.com/JacobLinCool/node-cloudflared/issues"
     },
-    "packageManager": "pnpm@10.33.2",
-    "pnpm": {
-        "onlyBuiltDependencies": [
-            "esbuild"
-        ]
-    }
+    "packageManager": "pnpm@11.21.0"
 }