Maintenance pass: security hardening, dep bumps, CI workflows

.github/workflows/check.yml

@@ -0,0 +1,28 @@
+name: Check
+
+on:
+  pull_request:
+    branches:
+      - master
+  workflow_call:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22.x"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test

.github/workflows/release.yml

@@ -0,0 +1,41 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  check:
+    uses: ./.github/workflows/check.yml
+
+  release:
+    needs: check
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24.x"
+          registry-url: "https://registry.npmjs.org"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Bump version
+        uses: phips28/gh-action-bump-version@v11.0.7
+        with:
+          tag-prefix: ""
+
+      - name: Publish to NPM
+        run: npm publish --access public --provenance

README.md

@@ -4,7 +4,7 @@ Formson is a FormData to JSON converter.
 
 It supports:
 
-- Dot notation to create nestable objects
+- Dot notation to create nested objects
 - Square bracket notation to create arrays
 - Mixed object/array structures