diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b24f014f..ed3b5ad7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,9 +6,14 @@ updates:
       interval: cron
       cronjob: "37 3 11 * *"
       timezone: Europe/Berlin
+    open-pull-requests-limit: 15
     cooldown:
       default-days: 7
     ignore:
+      - dependency-name: "typescript"
+        update-types:
+          - "version-update:semver-minor"
+          - "version-update:semver-major"
       - dependency-name: "@types/node"
         update-types:
           - "version-update:semver-major"
@@ -20,4 +25,4 @@ updates:
       interval: cron
       cronjob: "17 4 23 * *"
       timezone: Europe/Berlin
-    open-pull-requests-limit: 30
+    open-pull-requests-limit: 15
diff --git a/.github/workflows/test-and-release.yml b/.github/workflows/test-and-release.yml
index 34956f56..7699af89 100644
--- a/.github/workflows/test-and-release.yml
+++ b/.github/workflows/test-and-release.yml
@@ -13,10 +13,16 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+-**"
   pull_request: {}
 
-# Cancel previous PR/branch runs when a new commit is pushed
+# Cancel previous PR/branch runs when a new commit is pushed.
+# Release runs (tag pushes) are never cancelled - cancelling them aborts the deploy job and
+# leaves the release half finished, which the ioBroker repo checker reports as W3032.
 concurrency:
-  group: ${{ github.ref }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
+
+# Restrict the default GITHUB_TOKEN to read-only; the deploy job widens this for itself.
+permissions:
+    contents: read
 
 jobs:
   # Performs quick checks before the expensive test runs
@@ -39,7 +45,11 @@ jobs:
     needs: check-and-lint
 
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     strategy:
+      # Do not cancel the remaining matrix legs when one of them fails,
+      # otherwise a single flaky OS/node combination hides all other results
+      fail-fast: false
       matrix:
         node-version: [22.x, 24.x]
         os: [ubuntu-latest, windows-latest, macos-latest]
diff --git a/.gitignore b/.gitignore
index 3753ffbe..cba5ff6e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@ nbproject
 iobroker.*.tgz
 
 Thumbs.db
+.DS_Store
 launch.json
 .commitinfo
 
diff --git a/README.md b/README.md
index c45c6f36..4010e760 100644
--- a/README.md
+++ b/README.md
@@ -330,6 +330,9 @@ This is a personal donation link for DutchmanNL and is not related to the ioBrok
     ### __WORK IN PROGRESS__
 -->
 ## Changelog
+### __WORK IN PROGRESS__
+* (DutchmanNL) Maintenance: raise Node.js to 22, modernise CI and release tooling, update dependencies, resolve repository checker findings
+
 ### 0.5.6 (2026-08-02)
 * The monthly basic price is booked as a full charge when the tariff first becomes valid and at the beginning of every following calendar month, instead of being spread over the days of a month ([#1193](https://github.com/DrozmotiX/ioBroker.sourceanalytix/pull/1193)).
 * **Valid from** now also defines the first month the monthly basic price is charged, while tariffs without a validity date keep starting at the beginning of the current calendar year ([#1193](https://github.com/DrozmotiX/ioBroker.sourceanalytix/pull/1193)).
diff --git a/eslint.config.mjs b/eslint.config.mjs
index 63eb9fe2..6ecdfbbd 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -6,6 +6,7 @@ export default [
 		ignores: [
 			".dev-server/",
 			".vscode/",
+			".claude/",
 			"*.test.js",
 			"test/**/*.js",
 			"admin/admin.d.ts",