chore(main): release 5.0.1

[github-actions]

🤖 I have created a release beep boop

5.0.1 (2026-05-22)

Bug fixes

• index: add proxy-revalidate directive to cache-control (#388) (9c3b164)

Continuous integration

• add lock-threads workflow; fix concurrency groups (#370) (d7565a3)
• cd: make provenance publishing explicit (#387) (b7e4b74)
• ci: only send coverage to coveralls on main (#365) (1da01eb)
• ci: use reusable code quality workflow (#399) (00aed52)
• codeql: check cjs, mjs, and ts files (#376) (a39d55a)
• deps: bump actions/checkout from 5 to 6 (#381) (d84e300)
• deps: bump actions/dependency-review-action from 4.8.0 to 4.8.1 (#359) (64dddd1)
• deps: bump actions/dependency-review-action from 4.8.1 to 4.8.2 (#380) (06947f8)
• deps: bump actions/dependency-review-action from 4.8.2 to 4.8.3 (#389) (73499a2)
• deps: bump actions/dependency-review-action from 4.8.3 to 4.9.0 (#394) (c359e8c)
• deps: bump actions/setup-node from 5 to 6 (#360) (3f7285d)
• deps: bump coverallsapp/github-action from 2.3.6 to 2.3.7 (#379) (9584f4c)
• deps: bump fastify/github-action-merge-dependabot (#363) (0340515)
• deps: bump fastify/github-action-merge-dependabot (#397) (f0ae887)
• deps: bump github/codeql-action from 3 to 4 (#361) (de9c165)
• deps: bump googleapis/release-please-action from 4.3.0 to 4.4.0 (#362) (b48c933)
• deps: bump googleapis/release-please-action from 4.4.0 to 5.0.0 (#396) (ed6fa35)
• deps: bump JustinBeckwith/linkinator-action from 1.11.0 to 2.3 (#358) (a5dbd8e)
• link-check: use reusable workflow (#372) (c9aa277)
• link-check: use sha instead of tag (#400) (c4961df)
• lock-threads: reduce frequency from daily to monthly (#403) (f3ddd88)
• lock-threads: set cron to every day (#371) (06d6732)
• use full-length commit sha for github owned actions (#407) (025c6b4)

Dependencies

• .devcontainer: add lockfile; use bookworm for base image (#408) (71c99ca)
• dependabot: group github-owned updates (#401) (c35d4a7)
• deps-dev: bump @eslint/compat in the eslint group (#382) (4bff9ad)
• deps-dev: bump @fdawgs/eslint-config in the eslint group (#364) (70206f7)
• deps-dev: bump @types/node from 24.10.4 to 25.0.3 (#383) (28f5fe4)
• deps-dev: bump c8 from 10.1.3 to 11.0.0 (#391) (4d0fe9b)
• deps-dev: bump licensee from 11.1.1 to 12.0.1 (#384) (bebcbfa)
• deps-dev: bump typescript from 5.9.3 to 6.0.2 (#395) (b1256cb)
• deps-dev: remove husky (#373) (ebc1b1a)

Documentation

• readme: use shell over bash for command examples (#392) (1289186)

Improvements

• index: freeze CACHE_HEADERS object (#377) (31651e8)

Miscellaneous

• .devcontainer: remove prepare script call (#378) (874ac08)
• .editorconfig: add file to enforce consistent coding styles (#366) (3641b4f)
• .editorconfig: use spaces for yml file indentation (#369) (1a0a552)
• .npmrc: add min-release-age (#398) (a22af0e)
• .nvmrc: remove redundant prefix (#404) (f51f301)
• .vscode: update js and telemetry settings (#393) (8ddd2ed)
• eslint.config: stop applying to jsx files (#368) (e27b1e8)
• fix typos (#402) (6cacec3)
• license: add contact email (#385) (71b377e)
• move tests from src to test dir (#374) (2188832)
• package: stop running lint:prettier twice on test call (#386) (2ebc3a5)
• rename lint scripts to reflect use (#356) (6e28758)
• tidy dotfiles, remove redundant deps (#375) (80420ea)

---

This PR was generated with Release Please. See documentation.