diff --git a/.github/workflows/pr-checks.yaml b/.github/workflows/pr-checks.yaml
new file mode 100644
index 0000000..0128030
--- /dev/null
+++ b/.github/workflows/pr-checks.yaml
@@ -0,0 +1,31 @@
+name: pr-checks
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+    branches:
+      - main
+jobs:
+  build-test-lint:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version:
+          - 18.x
+          - 20.x
+          - 22.x
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+      - name: Install
+        run: npm ci
+      - name: Build
+        run: npm run build
+      - name: Test
+        run: npm run test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..61b34f0
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,48 @@
+on:
+  push:
+    branches:
+      - main
+name: release-please
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{secrets.GH_TOKEN}}
+    steps:
+      - name: Release please
+        uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          release-type: node
+      - name: Checkout
+        uses: actions/checkout@v4
+        if: ${{ steps.release.outputs.release_created }}
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        if: ${{ steps.release.outputs.release_created }}
+        with:
+          node-version: 18
+          registry-url: 'https://registry.npmjs.org'
+      - name: Install
+        if: ${{ steps.release.outputs.release_created }}
+        run: |
+          npm ci
+      - name: Build
+        if: ${{ steps.release.outputs.release_created }}
+        run: |
+          npm run build
+      - name: Generate SBOM
+        if: ${{ steps.release.outputs.release_created }}
+        run: |
+          npm sbom --sbom-format=cyclonedx --omit=dev --omit=peer > bom.json
+          gh release upload ${{ steps.release.outputs.tag_name }} ./bom.json
+      - name: Publish to NPM
+        if: ${{ steps.release.outputs.release_created }}
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+        run: npm publish
diff --git a/example/package-lock.json b/example/package-lock.json
index 3a3170c..9aa62b9 100644
--- a/example/package-lock.json
+++ b/example/package-lock.json
@@ -10,7 +10,7 @@
       "license": "ISC",
       "dependencies": {
         "express": "^4.18.2",
-        "extended-eventsource": "^1.4.9",
+        "extended-eventsource": "^1.5.0",
         "serve-static": "^1.15.0",
         "ssestream": "^1.1.0"
       },
@@ -390,9 +390,9 @@
       }
     },
     "node_modules/extended-eventsource": {
-      "version": "1.4.9",
-      "resolved": "https://registry.npmjs.org/extended-eventsource/-/extended-eventsource-1.4.9.tgz",
-      "integrity": "sha512-x0SMAw57jEaiBKLQWTatVBZkT/PRuL5hdiEP6s8GKqeQOapBRwnohI6e8zGM0XStolQrQe+L6Wvin8G0UthRbw=="
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/extended-eventsource/-/extended-eventsource-1.5.0.tgz",
+      "integrity": "sha512-qDCQQI37Wj2tv/GG8MwT+Rbq3iGz+mUaoL+cf/3moOyiDve5z9/1mou30Iog15++AIEuibhB6nkRuNK8jxQSFQ=="
     },
     "node_modules/finalhandler": {
       "version": "1.2.0",
diff --git a/example/package.json b/example/package.json
index 89ac938..0889261 100644
--- a/example/package.json
+++ b/example/package.json
@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "express": "^4.18.2",
-    "extended-eventsource": "^1.4.9",
+    "extended-eventsource": "^1.5.1",
     "serve-static": "^1.15.0",
     "ssestream": "^1.1.0"
   }