diff --git a/.cspell.config.yml b/.cspell.config.yml
new file mode 100644
index 0000000..d8f11f9
--- /dev/null
+++ b/.cspell.config.yml
@@ -0,0 +1,28 @@
+version: "0.2"
+words:
+  - adafruit
+  - armhf
+  - bndy
+  - BUILDSWIGNODE
+  - CFLAGS
+  - cpack
+  - Doxyfile
+  - elif
+  - fqbn
+  - gnueabihf
+  - gnux
+  - libboost
+  - libclang
+  - libncurses
+  - mbed
+  - megaavr
+  - MQTT
+  - MRAA
+  - pigpio
+  - pipx
+  - pkgs
+  - samd
+  - Seeeduino
+  - setuptools
+  - SPIDEV
+  - zizmor
diff --git a/.gitattributes b/.gitattributes
index 9fa452f..a2dd1b0 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -4,3 +4,14 @@
 # Explicitly declare text files you want to always be normalized and converted
 # to native line endings on checkout.
 *.sh text eol=lf
+*.yml text eol=lf
+*.yaml text eol=lf
+*.toml text eol=lf
+*.py text eol=lf
+*.md text eol=lf
+*.txt text eol=lf
+*.scss text eol=lf
+*.html text eol=lf
+LICENSE text eol=lf
+.gitignore text eol=lf
+.gitattributes text eol=lf
diff --git a/.github/workflows/cliff.toml b/.github/cliff.toml
similarity index 78%
rename from .github/workflows/cliff.toml
rename to .github/cliff.toml
index acb66aa..8c13fcd 100644
--- a/.github/workflows/cliff.toml
+++ b/.github/cliff.toml
@@ -61,14 +61,14 @@ Full commit diff: [`{% if previous.version -%}
 {%- endif %}...{{ last_commit }}`][{{ this_version }}]
 {% if github.contributors | filter(attribute="is_first_time", value=true) | length != 0 %}
   ## New Contributors
-{%- endif -%}
+    {% for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
+    - \\@{{ contributor.username }} made their first contribution
+        {%- if contributor.pr_number %} in \
+            [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
+        {%- endif %}
+    {%- endfor %}
+{% endif %}
 
-{% for contributor in github.contributors | filter(attribute="is_first_time", value=true) %}
-  * \\@{{ contributor.username }} made their first contribution
-    {%- if contributor.pr_number %} in \
-      [#{{ contributor.pr_number }}]({{ self::remote_url() }}/pull/{{ contributor.pr_number }}) \
-    {%- endif %}
-{%- endfor %}\n
 """
 # template for the changelog footer
 footer = """
@@ -95,6 +95,7 @@ commit_preprocessors = [
 ]
 # regex for parsing and grouping commits
 commit_parsers = [
+    # The order of parsers matters. Put rules for PR labels first to prioritize PR labels.
     { field = "github.pr_labels", pattern = "breaking", group = "<!-- 0 --> 💥 Breaking changes" },
     { field = "github.pr_labels", pattern = "breaking-change", group = "<!-- 0 --> 💥 Breaking changes" },
     { field = "github.pr_labels", pattern = "feature", group = "<!-- 1 --> 🚀 Added" },
@@ -111,7 +112,24 @@ commit_parsers = [
     { field = "github.pr_labels", pattern = "skip-changelog", skip = true },
     { field = "github.pr_labels", pattern = "no-changelog", skip = true },
     { field = "github.pr_labels", pattern = "invalid", skip = true },
-    # The order of parsers matters. Put rules for PR labels first to prioritize PR labels.
+    # Here are rules that apply to conventional commits
+    { field = "group", pattern = "add", group = "<!-- 1 --> 🚀 Added" },
+    { field = "group", pattern = "feat", group = "<!-- 1 --> 🚀 Added" },
+    { field = "group", pattern = "fix", group = "<!-- 4 --> 🛠️ Fixed" },
+    { field = "group", pattern = "perf", group = "<!-- 13 --> ⚡ Performance" },
+    { field = "group", pattern = "build", group = "<!-- 6 --> 📦 Dependency updates" },
+    { field = "group", pattern = "test", group = "<!-- 7 --> 🚦 Tests" },
+    { field = "group", pattern = "docs", group = "<!-- 8 --> 📝 Documentation" },
+    { field = "group", pattern = "chore", group = "<!-- 9 --> 🗨️ Changed" },
+    { field = "group", pattern = "style", group = "<!-- 9 --> 🗨️ Changed" },
+    # This rule seems broken when unconventional commits are involved.
+    # { field = "breaking", pattern = true, group = "<!-- 0 --> 💥 Breaking changes" },
+    { field = "group", pattern = "remove", group = "<!-- 3 --> 🗑️ Removed" },
+    { field = "group", pattern = "deprecate", group = "<!-- 2 --> 🚫 Deprecated" },
+    { field = "group", pattern = "delete", group = "<!-- 3 --> 🗑️ Removed" },
+    { field = "group", pattern = "security", group = "<!-- 5 --> 🔐 Security" },
+    { field = "group", pattern = "refactor", group = "<!-- 9 --> 🗨️ Changed" },
+    # Here are rules that apply to unconventional commits
     { message = "^[a|A]dd", group = "<!-- 1 --> 🚀 Added" },
     { message = "^[s|S]upport", group = "<!-- 1 --> 🚀 Added" },
     { message = "^.*: support", group = "<!-- 1 --> 🚀 Added" },
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e21abd3..3b555f8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,8 +10,21 @@ updates:
     # default location of `.github/workflows`
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    cooldown:
+      default-days: 5
     groups:
       actions:
         patterns:
           - "*"
+  - package-ecosystem: "pip"
+    # recursively finds requirements.txt files from repo root
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    cooldown:
+      default-days: 5
+    groups:
+      pip:
+        patterns:
+          - "*"
diff --git a/.github/workflows/increment_version.py b/.github/increment_version.py
similarity index 85%
rename from .github/workflows/increment_version.py
rename to .github/increment_version.py
index 98e1bc8..a2256d6 100644
--- a/.github/workflows/increment_version.py
+++ b/.github/increment_version.py
@@ -8,7 +8,8 @@
 from pathlib import Path
 import re
 import subprocess
-from typing import cast, Tuple, List, Sequence, Dict
+from typing import cast, Tuple, List, Set, Dict
+from shutil import which
 import sys
 from difflib import unified_diff
 
@@ -26,7 +27,7 @@ def get_version() -> Tuple[VERSION_TUPLE, str]:
         capture_output=True,
         check=True,
     )
-    tags: Sequence[VERSION_TUPLE] = set()  # using a set to avoid duplicates
+    tags: Set[VERSION_TUPLE] = set()  # using a set to avoid duplicates
     tag_pattern = re.compile(r"tag:\s+(?:RF24)?v?(\d+\.\d+\.?[A-Za-z0-9-_]*)")
     for line in result.stdout.decode(encoding="utf-8").splitlines():
         ver_tags = cast(List[str], tag_pattern.findall(line))
@@ -40,10 +41,11 @@ def get_version() -> Tuple[VERSION_TUPLE, str]:
                 print(ver_tag, "is an incomplete version spec; appending zero(s)")
                 ver_tuple += (0,) * (3 - len(ver_tuple))
             tags.add(cast(VERSION_TUPLE, ver_tuple))
-    tags = sorted(tags)  # sort by version & converts to a list
-    tags.reverse()  # to iterate from newest to oldest versions
+    sorted_tags = sorted(tags)  # sort by version & converts to a list
+    sorted_tags.reverse()  # to iterate from newest to oldest versions
+
     print("found version tags:")
-    for tag in tags:
+    for tag in sorted_tags:
         print("    v" + ".".join([str(t) for t in tag]), flush=True)
 
     # get current branch
@@ -63,17 +65,17 @@ def get_version() -> Tuple[VERSION_TUPLE, str]:
     # filter tags and find the appropriate latest tag according to current branch
     if branch.endswith("1.x"):
         print("filtering tags for branch", branch)
-        for tag in tags:
+        for tag in sorted_tags:
             if tag[0] == 1:
-                ver_tag = tag
+                ret_ver = tag
                 break
         else:
             raise RuntimeError(f"Found no v1.x tags for branch {branch}")
     else:
         print("treating branch", repr(branch), "as latest stable branch", flush=True)
-        ver_tag = tags[0]
-    print("Current version:", ".".join([str(x) for x in ver_tag]), flush=True)
-    return ver_tag, branch
+        ret_ver = sorted_tags[0]
+    print("Current version:", ".".join([str(x) for x in ret_ver]), flush=True)
+    return ret_ver, branch
 
 
 def increment_version(version: VERSION_TUPLE, bump: str = "patch") -> VERSION_TUPLE:
@@ -84,7 +86,7 @@ def increment_version(version: VERSION_TUPLE, bump: str = "patch") -> VERSION_TU
     # zero out minor and patch components if needed
     for i in range(component + 1, len(COMPONENTS)):
         new_ver[i] = 0
-    return tuple(new_ver)
+    return (new_ver[0], new_ver[1], new_ver[2])
 
 
 def get_changelog(
@@ -100,27 +102,27 @@ def get_changelog(
     if full:
         old = changelog.read_text(encoding="utf-8")
     output = changelog
-    exe_name = "git-cliff"
-    if environ.get("CI", "false") == "true":
-        exe_name = (
-            (GIT_CLIFF_CONFIG.parent.parent.parent / exe_name).resolve().as_posix()
-        )
+    exe_name = which("git-cliff")
+    assert exe_name is not None, "git-cliff executable not found in PATH"
+    exe_name = Path(exe_name).as_posix()
     args = [exe_name, "--use-branch-tags", "--github-repo", f"nRF24/{Path.cwd().name}"]
     if not full:
         args.append("--unreleased")
-        output = str(RELEASE_NOTES)
+        output = RELEASE_NOTES
     env = {
         "FIRST_COMMIT": first_commit,
         "GIT_CLIFF_CONFIG": str(GIT_CLIFF_CONFIG),
         "GIT_CLIFF_OUTPUT": str(output),
         "GIT_CLIFF_TAG": f"v{tag}",
     }
+    if "GITHUB_TOKEN" in environ:
+        env["GITHUB_TOKEN"] = environ["GITHUB_TOKEN"]
     if not full:
         env["GIT_CLIFF__CHANGELOG__HEADER"] = ""
     subprocess.run(args, env=env, check=True)
     if full:
         new = changelog.read_text(encoding="utf-8")
-        changes = list(unified_diff(old, new))
+        changes = list(unified_diff(old.splitlines(), new.splitlines()))
         return len(changes) != 0
     return False
 
@@ -155,14 +157,14 @@ def update_metadata_files(version: str) -> bool:
     if arduino_meta_file.exists():
         # simple search and replace
         ver_pattern = re.compile(r"version=(\d+\.\d+\.?\d*)")
-        data = arduino_meta_file.read_text(encoding="utf-8")
-        ver_match = ver_pattern.search(data)
+        ini_data = arduino_meta_file.read_text(encoding="utf-8")
+        ver_match = ver_pattern.search(ini_data)
         assert ver_match is not None, "could not find version in " + str(
             arduino_meta_file
         )
         if ver_match.group(1) != version:
-            data = ver_pattern.sub(f"version={version}", data)
-            arduino_meta_file.write_text(data, encoding="utf-8", newline="\n")
+            ini_data = ver_pattern.sub(f"version={version}", ini_data)
+            arduino_meta_file.write_text(ini_data, encoding="utf-8", newline="\n")
             made_changes = True
 
     return made_changes
diff --git a/.github/requirements.txt b/.github/requirements.txt
new file mode 100644
index 0000000..1d1e7ce
--- /dev/null
+++ b/.github/requirements.txt
@@ -0,0 +1 @@
+git-cliff==2.10.1
diff --git a/.github/workflows/arduino_size_deltas.yaml b/.github/workflows/arduino_size_deltas.yaml
index 40b52a5..d3d0b12 100644
--- a/.github/workflows/arduino_size_deltas.yaml
+++ b/.github/workflows/arduino_size_deltas.yaml
@@ -18,6 +18,6 @@ jobs:
           pattern: arduino-deltas-*
           path: ${{ inputs.reports-path }}
 
-      - uses: 2bndy5/arduino-report-size-deltas@v1
+      - uses: 2bndy5/arduino-report-size-deltas@5d226f8792e1cca65534f3697748af289138af25 # v1.0.4
         with:
           sketches-reports-source: ${{ inputs.reports-path }}
diff --git a/.github/workflows/build_arduino.yaml b/.github/workflows/build_arduino.yaml
index d29e142..035ac3c 100644
--- a/.github/workflows/build_arduino.yaml
+++ b/.github/workflows/build_arduino.yaml
@@ -30,7 +30,7 @@ on:
           - source-url: https://github.com/<owner>/<repo>.git
             version: <branch_name>
           ```
-          Otherwise, just the lib's name in the Arduino Lib Manager will suffic:
+          Otherwise, just the lib's name in the Arduino Lib Manager will suffice:
           ```yml
           - source-url: https://github.com/nRF24/RF24Network.git
             version: master
@@ -73,15 +73,19 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       
-      - name: sketch reports
+      - name: Delta reports' artifact name
         if: inputs.enable-deltas-report
         id: delta-report-name
+        env:
+          FQBN: ${{ inputs.fqbn }}
         run: >-
-          echo "report-name=${{ inputs.fqbn }}" | tr : - >> "$GITHUB_OUTPUT"
+          echo "report-name=${FQBN}" | tr : - >> "${GITHUB_OUTPUT}"
 
       - name: Compile examples
-        uses: arduino/compile-sketches@main
+        uses: arduino/compile-sketches@8ac27e99289705c4abec832089575d687b859227 # v1.1.2
         with:
           # cli-version: '0.33.0'
           sketch-paths: ${{ inputs.sketch-paths }}
diff --git a/.github/workflows/build_docs.yaml b/.github/workflows/build_docs.yaml
index 026404d..0c75ed7 100644
--- a/.github/workflows/build_docs.yaml
+++ b/.github/workflows/build_docs.yaml
@@ -3,131 +3,76 @@ name: Build Docs
 on:
   workflow_call:
     inputs:
-      deploy-gh-pages:
-        required: false
-        type: boolean
       doxygen-version:
         required: false
         type: string
         default: '1.9.6'
 
+permissions: {}
+
 jobs:
   get-info:
     runs-on: ubuntu-latest
     outputs:
       lib-version: ${{ steps.fetch-repo.outputs.release }}
-      lib-name: ${{ steps.fetch-repo.outputs.name }}
-      mk-sphinx: ${{ steps.fetch-repo.outputs.has-sphinx-docs }}
     steps:
       - name: Checkout repo w/o history
         if: endsWith(github.repository, 'RF24Gateway') == false
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - name: Checkout repo w/ history
         if: endsWith(github.repository, 'RF24Gateway')
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: get latest release version number
         id: fetch-repo
         run: |
           if [[ -f library.properties ]]; then
-            echo "release=v$(awk -F "=" '/version/ {print $2}' library.properties)" >> $GITHUB_OUTPUT
+            echo "release=v$(awk -F "=" '/version/ {print $2}' library.properties)" >> "${GITHUB_OUTPUT}"
           else
-            echo "release=$(git describe --tags | grep -o -E 'v[0-9]+\.[0-9]+\.[0-9]+')" >> $GITHUB_OUTPUT
+            echo "release=$(git describe --tags | grep -o -E 'v[0-9]+\.[0-9]+\.[0-9]+')" >> "${GITHUB_OUTPUT}"
           fi
-          echo "name=$(echo ${{ github.repository }} | sed 's;.\+/;;')" >> $GITHUB_OUTPUT
-          echo "has-sphinx-docs=$(if [[ -d docs/sphinx ]]; then echo true; else echo false; fi)" >> $GITHUB_OUTPUT
 
-  build-doxygen:
+  build:
     runs-on: ubuntu-latest
     needs: [get-info]
     steps:
       # - name: install Doxygen static libclang deps
       #   run: sudo apt-get install libclang1-16 libclang-cpp16
 
-      - name: install doxygen from SF binary archives
+      - name: Install Doxygen
         env:
           DOXYGEN_VERSION: ${{ inputs.doxygen-version }}
-        run: |
+        run: |-
           mkdir .doxygen && cd .doxygen
-          curl -L https://sourceforge.net/projects/doxygen/files/rel-$DOXYGEN_VERSION/doxygen-$DOXYGEN_VERSION.linux.bin.tar.gz > doxygen.tar.gz
+          curl -L "https://github.com/doxygen/doxygen/releases/download/Release_${DOXYGEN_VERSION//./_}/doxygen-${DOXYGEN_VERSION}.linux.bin.tar.gz" --output ${{ runner.temp }}/doxygen.tar.gz
+          cd ${{ runner.temp }}
           gunzip doxygen.tar.gz
           tar xf doxygen.tar
-          cd doxygen-$DOXYGEN_VERSION
+          cd "doxygen-${DOXYGEN_VERSION}"
           sudo make install
 
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
-      - name: overwrite doxygen tags
+      - name: Overwrite doxygen tags
         working-directory: docs
-        run: |
+        env:
+          LIB_VERSION: ${{ needs.get-info.outputs.lib-version }}
+        run: |-
           touch doxygenAction
-          echo "PROJECT_NUMBER = ${{ needs.get-info.outputs.lib-version }}" >> doxygenAction
+          echo "PROJECT_NUMBER = ${LIB_VERSION}" >> doxygenAction
           echo -e "\n@INCLUDE = doxygenAction" >> Doxyfile
 
       - run: doxygen
         working-directory: docs
 
-      - name: Save doxygen docs as artifact
-        uses: actions/upload-artifact@v5
+      - name: Upload github pages artifact
+        uses: actions/upload-pages-artifact@v4
         with:
-          name: ${{ needs.get-info.outputs.lib-name }}_doxygen_docs
+          name: ${{ github.event.repository.name }}_doxygen_docs
           path: ${{ github.workspace }}/docs/html
-
-      - name: Save doxygen XML as artifact
-        if: needs.get-info.outputs.mk-sphinx == 'true'
-        uses: actions/upload-artifact@v5
-        with:
-          name: ${{ needs.get-info.outputs.lib-name }}_doxygen_xml
-          path: ${{ github.workspace }}/docs/sphinx/xml
-
-  build-sphinx:
-    needs: [get-info, build-doxygen]
-    if: needs.get-info.outputs.mk-sphinx == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/setup-python@v6
-        with:
-          python-version: 3.x
-
-      - uses: actions/checkout@v6
-
-      - name: download XML artifact
-        uses: actions/download-artifact@v6
-        with:
-          name: ${{ needs.get-info.outputs.lib-name }}_doxygen_xml
-          path: ${{ github.workspace }}/docs/sphinx/xml
-
-      - name: Install sphinx deps
-        run: python -m pip install -r docs/sphinx/requirements.txt
-
-      - name: build docs with Sphinx
-        working-directory: docs
-        run: sphinx-build sphinx _build
-
-      - name: Save sphinx docs as artifact
-        uses: actions/upload-artifact@v5
-        with:
-          name: ${{ needs.get-info.outputs.lib-name }}_sphinx_docs
-          path: ${{ github.workspace }}/docs/_build
-
-  deploy-docs:
-    runs-on: ubuntu-latest
-    needs: [get-info, build-doxygen]
-    if: inputs.deploy-gh-pages
-    steps:
-      - name: get repo info
-        id: lib-info
-        run: echo "name=$(echo ${{ github.repository }} | sed 's;.\+/;;')" >> $GITHUB_OUTPUT
-
-      - name: downlod artifact
-        uses: actions/download-artifact@v6
-        with:
-          name: ${{ needs.get-info.outputs.lib-name }}_doxygen_docs
-          path: docs
-
-      - name: upload to github pages
-        uses: peaceiris/actions-gh-pages@v4
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./docs
diff --git a/.github/workflows/build_linux_cmake.yaml b/.github/workflows/build_linux_cmake.yaml
index 016846d..96c2f58 100644
--- a/.github/workflows/build_linux_cmake.yaml
+++ b/.github/workflows/build_linux_cmake.yaml
@@ -18,9 +18,6 @@ on:
       examples-path:
         required: false
         type: string
-      deploy-release:
-        required: false
-        type: boolean
       py-wrapper-path:
         required: false
         type: string
@@ -40,78 +37,85 @@ on:
         default: master
         description: git ref of the RF24Mesh lib dependency
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
     env:
       RF24_DRIVER: ${{ inputs.driver }}
       # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
-      BUILD_TYPE: Release
+      # This env var is supported by CMake as of v3.22+
+      CMAKE_BUILD_TYPE: Release
     steps:
-      # - name: provide toolchain (for x86_64)
+      # - name: Provide toolchain (for x86_64)
       #   if: ${{ inputs.compiler == 'x86_64' }}
       #   run: |
       #     sudo apt-get update
       #     sudo apt-get install gcc-x86-64-linux-gnux32 g++-x86-64-linux-gnux32
 
-      # - name: provide toolchain (for i686)
+      # - name: Provide toolchain (for i686)
       #   if: ${{ inputs.compiler == 'i686' }}
       #   run: |
       #     sudo apt-get update
       #     sudo apt-get install gcc-i686-linux-gnu g++-i686-linux-gnu
 
-      - name: provide toolchain (for arm64)
+      - name: Provide toolchain (for arm64)
         if: ${{ inputs.compiler == 'arm64' }}
         run: |
           sudo apt-get update
           sudo apt-get install gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
 
-      - name: provide toolchain (for armhf)
+      - name: Provide toolchain (for armhf)
         if: ${{ inputs.compiler == 'armhf' }}
-        run: |
+        run: |-
           sudo apt-get update
           sudo apt-get install gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf
 
-      - name: get repo info
+      - name: Get repo info
         id: lib-info
-        run: |
-          lib_name=$(echo ${{ github.repository }} | sed 's;.\+/;;')
-          echo "name=$lib_name" >> $GITHUB_OUTPUT
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
+        run: |-
           lib_deps=''
-          if [[ $lib_name == 'RF24Mesh' ]]; then
+          if [[ "${REPO_NAME}" == 'RF24Mesh' ]]; then
               lib_deps='RF24Network'
-          elif [[ $lib_name == 'RF24Gateway' ]]; then
+          elif [[ "${REPO_NAME}" == 'RF24Gateway' ]]; then
               lib_deps='RF24Network;RF24Mesh'
           fi
-          echo "deps=$lib_deps" >> $GITHUB_OUTPUT
+          echo "deps=$lib_deps" >> "${GITHUB_OUTPUT}"
 
-      - name: checkout RF24
+      - name: Checkout RF24
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24
           path: RF24
           ref: ${{ inputs.rf24-ref }}
 
-      - name: provide MRAA
+      - name: Provide MRAA
         if: inputs.driver == 'MRAA'
-        run: |
+        env:
+          # this env var is supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: ${{ github.workspace }}/RF24/cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           git clone https://github.com/intel-iot-devkit/mraa.git
           cd mraa
           mkdir build
           cd build
-          cmake .. -D BUILDSWIGNODE=OFF \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=${{ github.workspace }}/RF24/cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake .. -D BUILDSWIGNODE=OFF
           sudo make install
 
-      - name: provide WiringPi
+      - name: Provide WiringPi
         if: inputs.driver == 'wiringPi' && inputs.compiler == 'default'
-        run: |
+        run: |-
           git clone https://github.com/WiringPi/WiringPi
           cd WiringPi
           ./build
 
-      # - name: provide WiringPi (with toolchain compilers)
+      # - name: Provide WiringPi (with toolchain compilers)
       #   if: inputs.driver == 'wiringPi' && inputs.compiler != 'default'
       #   env:
       #     CC: /usr/bin/${{ inputs.usr-dir }}-gcc
@@ -121,9 +125,14 @@ jobs:
       #     cd WiringPi
       #     ./build
 
-      - name: provide pigpio
+      - name: Provide pigpio
         if: inputs.driver == 'pigpio'
-        run: |
+        env:
+          # this env var is supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: ${{ github.workspace }}/RF24/cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           git clone https://github.com/joan2937/pigpio.git
           cd pigpio
           git fetch --tags
@@ -131,173 +140,173 @@ jobs:
           git checkout $latestTag
           mkdir build
           cd build
-          cmake .. -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=${{ github.workspace }}/RF24/cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake .. 
           make
           sudo make install
 
-      - name: build & install RF24
+      - name: Build & install RF24
         if: endsWith(github.repository, 'RF24') == false
         working-directory: RF24
-        run: |
+        env:
+          # this env var is supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           mkdir build
           cd build
-          cmake .. -D CMAKE_BUILD_TYPE=$BUILD_TYPE \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake ..
           sudo make install
 
-      - name: checkout RF24Network
+      - name: Checkout RF24Network
         if: contains(steps.lib-info.outputs.deps, 'RF24Network') || endsWith(github.repository, 'RF24Network')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24Network
           path: RF24Network
           ref: ${{ inputs.rf24network-ref }}
 
-      - name: build & install RF24Network
+      - name: Build & install RF24Network
         if: contains(steps.lib-info.outputs.deps, 'RF24Network')
         working-directory: RF24Network
-        run: |
+        env:
+          # these env vars are supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           mkdir build
           cd build
-          cmake .. -D CMAKE_BUILD_TYPE=$BUILD_TYPE \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake ..
           sudo make install
 
-      - name: checkout RF24Mesh repo
+      - name: Checkout RF24Mesh repo
         if: contains(steps.lib-info.outputs.deps, 'RF24Mesh') || endsWith(github.repository, 'RF24Mesh')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24Mesh
           path: RF24Mesh
           ref: ${{ inputs.rf24mesh-ref }}
 
-      - name: build & install RF24Mesh
+      - name: Build & install RF24Mesh
         working-directory: RF24Mesh
         if: contains(steps.lib-info.outputs.deps, 'RF24Mesh')
-        run: |
+        env:
+          # these env vars are supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: |-
           mkdir build
           cd build
-          cmake .. -D CMAKE_BUILD_TYPE=$BUILD_TYPE \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=cmake/toolchains/${{ inputs.compiler }}.cmake
+          cmake ..
           sudo make install
 
-      - name: checkout RF24Gateway repo
+      - name: Checkout RF24Gateway repo
         if: endsWith(github.repository, 'RF24Gateway')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24Gateway
           fetch-depth: 0  # for version number fetching in cmake
           path: RF24Gateway
           ref: ${{ github.sha }}
 
-      - name: create CMake build environment
-        run: cmake -E make_directory ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
-
-      - name: configure lib
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
-        run: |
-          cmake .. -D CMAKE_BUILD_TYPE=$BUILD_TYPE \
-          -D CMAKE_INSTALL_PREFIX=/usr/${{ inputs.usr-dir }} \
-          -D CMAKE_TOOLCHAIN_FILE=cmake/toolchains/${{ inputs.compiler }}.cmake
-
-      - name: build lib
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+      - name: Create CMake build environment
+        env:
+          BUILD_DIR: ${{ github.workspace }}/${{ github.event.repository.name }}/build
+        run: cmake -E make_directory "${BUILD_DIR}"
+
+      - name: Configure lib
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
+        env:
+          # these env vars are supported as of CMake v3.29+
+          CMAKE_INSTALL_PREFIX: /usr/${{ inputs.usr-dir }}
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: cmake/toolchains/${{ inputs.compiler }}.cmake
+        run: cmake ..
+
+      - name: Build lib
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         run: cmake --build .
 
-      - name: install lib
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+      - name: Install lib
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         run: sudo cmake --install .
 
-      - name: package lib
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+      - name: Package lib
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         run: sudo cpack
 
       - name: Save artifact
         uses: actions/upload-artifact@v5
         with:
-          name: pkg_${{ steps.lib-info.outputs.name }}_${{ inputs.compiler }}_${{ inputs.driver }}
-          path: |
-            ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/pkgs/*.deb
-            ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/pkgs/*.rpm
-
-      - name: Upload Release assets
-        if: inputs.deploy-release
-        uses: shogo82148/actions-upload-release-asset@v1
-        with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: "${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/pkgs/librf24*"
+          name: pkg_${{ github.event.repository.name }}_${{ inputs.compiler }}_${{ inputs.driver }}
+          path: |-
+            ${{ github.workspace }}/${{ github.event.repository.name }}/build/pkgs/*.deb
+            ${{ github.workspace }}/${{ github.event.repository.name }}/build/pkgs/*.rpm
 
-      - name: clean build environment
+      - name: Clean build environment
         if: inputs.examples-path != ''
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         run: sudo rm -r ./*
 
-      - name: provide ncurses
-        if: inputs.examples-path != ''
+      - name: Provide ncurses
+        # only done for native compilation because cross-compiling ncurses from
+        # source is prone to linker errors and takes a long time.
+        if: inputs.examples-path != '' && inputs.compiler == 'default'
         # This script assumes that any examples using ncurses reside in a 'ncurses' subdirectory
         # as is the case w/ RF24Mesh, RF24Gateway, and any new ncurses examples going forward.
-        run: |
-          if [[ -d ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/${{ inputs.examples-path }}/ncurses ]]; then
-            if [[ ${{ inputs.compiler }} == 'default' ]]; then
-              sudo apt-get install libncurses5-dev
-            else
-              echo "skipping the ncurses examples for cross-compiled builds"
-
-              # avoid cross-compiling linker problems in CI; this works locally but takes a while to build
-              # curl -L https://invisible-island.net/datafiles/release/ncurses.tar.gz > ncurses.tar.gz
-              # gunzip ncurses.tar.gz
-              # tar xf ncurses.tar
-              # cd ncurses-*
-              # ./configure --prefix=/usr/${{ inputs.usr-dir }} --build=${{ inputs.usr-dir }}
-              # make
-              # sudo make install
-            fi
+        env:
+          EXAMPLES_PATH: ${{ github.workspace }}/${{ github.event.repository.name }}/${{ inputs.examples-path }}/ncurses
+        run: |-
+          if [[ -d "${EXAMPLES_PATH}" ]]; then
+            sudo apt-get install libncurses5-dev
           else
             echo "ncurses is not needed for these examples"
           fi
 
-      - name: configure examples
+      - name: Configure examples
         if: inputs.examples-path != ''
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
-        run: |
-          cmake ../${{ inputs.examples-path }} \
-          -D CMAKE_TOOLCHAIN_FILE=../cmake/toolchains/${{ inputs.compiler }}.cmake
-
-      - name: build examples
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
+        env:
+          # this env var is supported as of CMake v3.21+
+          CMAKE_TOOLCHAIN_FILE: ../cmake/toolchains/${{ inputs.compiler }}.cmake
+          EXAMPLES_PATH: ../${{ inputs.examples-path }}
+        run: cmake "${EXAMPLES_PATH}"
+
+      - name: Build examples
         if: inputs.examples-path != ''
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         # doesn't build the RF24Mesh_Ncurses_Master example because we haven't cross-compiled it in this workflow
         run: cmake --build .
 
-      - name: provide python wrapper prerequisites
+      - name: Provide python wrapper prerequisites
         if: inputs.compiler == 'default' && inputs.py-wrapper-path != ''
         # python3-rpi.gpio is only required for physical hardware (namely the IRQ example)
         run: sudo apt-get install python3-dev libboost-python-dev python3-setuptools
 
-      - name: create alias symlink to libboost_python3*.so
+      - name: Create alias symlink to libboost_python3*.so
         if: inputs.compiler == 'default' && inputs.py-wrapper-path != ''
         id: symlink-boost-python
-        run: |
+        run: |-
           arch=$(ls /usr/lib/gcc | tail -1)
           arch_libs=/usr/lib/$arch
           boost_python_so=$(ls $arch_libs/libboost_python3*.so | tail -1)
           py_ver=$(echo $boost_python_so | sed -E 's/.*libboost_python([0-9])([0-9]+)\.so/\1.\2/')
-          echo "python version used by boost.pytrhon is $py_ver"
-          echo "python-version=$py_ver" >> $GITHUB_OUTPUT
+          echo "python version used by boost.python is $py_ver"
+          echo "python-version=$py_ver" >> "${GITHUB_OUTPUT}"
           sudo ln -s $boost_python_so $arch_libs/libboost_python3.so
 
-      # cross-compiling a python C extension is better done with pypa/cibuildwheel action
       - name: Set up Python version used by boost.python
         if: inputs.compiler == 'default' && inputs.py-wrapper-path != ''
         uses: actions/setup-python@v6
         with:
           python-version: ${{ steps.symlink-boost-python.outputs.python-version }}
 
-      - name: install python wrapper
+      - name: Install python wrapper
         if: inputs.compiler == 'default' && inputs.py-wrapper-path != ''
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/${{ inputs.py-wrapper-path }}
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/${{ inputs.py-wrapper-path }}
         run: python3 -m pip install .
diff --git a/.github/workflows/build_pico_sdk.yaml b/.github/workflows/build_pico_sdk.yaml
index 026bec0..e7a4255 100644
--- a/.github/workflows/build_pico_sdk.yaml
+++ b/.github/workflows/build_pico_sdk.yaml
@@ -27,54 +27,66 @@ on:
         default: examples_pico
         description: The path to the Pico SDK examples. Defaults to `examples_pico`.
 
+permissions: {}
 
 jobs:
   build:
     runs-on: ubuntu-latest
     env:
       # Customize the CMake build type here (Release, Debug, RelWithDebInfo, etc.)
-      BUILD_TYPE: Release
+      # this env var is supported by CMake as of v3.22+
+      CMAKE_BUILD_TYPE: Release
 
     steps:
-      - name: get repo info
+      - name: Get repo info
         id: lib-info
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
         run: |
-          lib_name=$(echo ${{ github.repository }} | sed 's;.\+/;;')
-          echo "name=$lib_name" >> $GITHUB_OUTPUT
+          echo "name=${REPO_NAME}" >> "${GITHUB_OUTPUT}"
           lib_deps=''
-          if [[ $lib_name == 'RF24Mesh' ]]; then
+          if [[ "${REPO_NAME}" == 'RF24Mesh' ]]; then
               lib_deps='RF24Network'
           fi
-          echo "deps=$lib_deps" >> $GITHUB_OUTPUT
+          echo "deps=${lib_deps}" >> "${GITHUB_OUTPUT}"
 
-      - name: checkout RF24 lib
+      - name: Checkout RF24 lib
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24
           path: RF24
           ref: ${{ inputs.rf24-ref }}
 
-      - name: checkout RF24Network lib
+      - name: Checkout RF24Network lib
         if: contains(steps.lib-info.outputs.deps, 'RF24Network') || endsWith(github.repository, 'RF24Network')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: nRF24/RF24Network
           path: RF24Network
           ref: ${{ inputs.rf24network-ref }}
 
-      - name: checkout RF24Mesh lib
+      - name: Checkout RF24Mesh lib
         if: endsWith(github.repository, 'RF24Mesh')
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           path: RF24Mesh
           ref: ${{ inputs.rf24mesh-ref }}
 
       - name: Install toolchain
-        run: sudo apt update && sudo apt install gcc-arm-none-eabi libnewlib-arm-none-eabi build-essential
+        run: >-
+          sudo apt update &&
+          sudo apt install
+          gcc-arm-none-eabi
+          libnewlib-arm-none-eabi
+          build-essential
 
       - name: Clone pico-sdk
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           repository: raspberrypi/pico-sdk
           # master branch is latest stable release
           path: pico-sdk
@@ -86,28 +98,31 @@ jobs:
         run: git submodule update --init
 
       - name: Create Build Environment
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}
         env:
           PICO_SDK_PATH: ${{ github.workspace }}/pico-sdk
-        run: cmake -E make_directory ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+          BUILD_DIR: ${{ github.workspace }}/${{ github.event.repository.name }}/build
+        run: cmake -E make_directory "${BUILD_DIR}"
 
       - name: Configure CMake
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         env:
           PICO_SDK_PATH: ${{ github.workspace }}/pico-sdk
-        run: cmake ../${{ inputs.examples-path }} -DCMAKE_BUILD_TYPE=$BUILD_TYPE -DPICO_BOARD=${{ inputs.board-id }}
+          EXAMPLES_PATH: ../${{ inputs.examples-path }}
+          PICO_BOARD: ${{ inputs.board-id }}
+        run: cmake "${EXAMPLES_PATH}" -D PICO_BOARD="${PICO_BOARD}"
 
       - name: Build
-        working-directory: ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build
+        working-directory: ${{ github.workspace }}/${{ github.event.repository.name }}/build
         # Execute the build. You can specify a specific target with "--target <NAME>"
-        run: cmake --build . --config $BUILD_TYPE
+        run: cmake --build . --config "${CMAKE_BUILD_TYPE}"
 
       - name: Save artifact
         uses: actions/upload-artifact@v5
         with:
           name: examples_pico_${{ inputs.board-id }}
           path: |
-            ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/*.uf2
-            ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/*.elf
-          # ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/*.hex
-          # ${{ github.workspace }}/${{ steps.lib-info.outputs.name }}/build/*.bin
+            ${{ github.workspace }}/${{ github.event.repository.name }}/build/*.uf2
+            ${{ github.workspace }}/${{ github.event.repository.name }}/build/*.elf
+          # ${{ github.workspace }}/${{ github.event.repository.name }}/build/*.hex
+          # ${{ github.workspace }}/${{ github.event.repository.name }}/build/*.bin
diff --git a/.github/workflows/build_platformio.yaml b/.github/workflows/build_platformio.yaml
index 79d7fb9..9b83040 100644
--- a/.github/workflows/build_platformio.yaml
+++ b/.github/workflows/build_platformio.yaml
@@ -15,7 +15,7 @@ on:
         description: |
           A space delimited string of lib names to install as extra dependencies.
           UPDATE: Each lib specified should be prefixed with a `-l ` like so: `-l <lib_spec>`.
-             This also allows for exra tools/frameworks/etc. See docs at
+             This also allows for extra tools/frameworks/etc. See docs at
              https://docs.platformio.org/en/latest/core/userguide/pkg/cmd_install.html
           NOTE: RF24 dependencies are automatically installed accordingly.
       rf24-ref:
@@ -34,68 +34,77 @@ on:
         default: master
         description: git ref of the RF24Mesh lib dependency
 
+permissions: {}
 
 jobs:
   run_pio:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
       - name: Cache pip
         uses: actions/cache@v4
         with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
-          restore-keys: |
-            ${{ runner.os }}-pip-
-
-      # - name: Cache PlatformIO
-      #   uses: actions/cache@v4
-      #   with:
-      #     path: |
-      #       ~/.cache/pip
-      #       ~/.platformio/.cache
-      #     key: ${{ runner.os }}-pio
+          path: |-
+            ~/.cache/pip
+            ~/.platformio/.cache
+          key: ${{ runner.os }}-pio-${{ inputs.board-id }}-${{ inputs.example-path }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: 3.x
 
-      - uses: actions/checkout@v6
-
-      - name: get lib info
+      - name: Get lib info
         id: lib-info
-        run: |
-          lib_name=$(echo ${{ github.repository }} | sed -e 's;.\+/;;')
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
+        run: |-
           rf24_deps=''
-          if [[ $lib_name == 'RF24Mesh' ]]; then
+          if [[ "${REPO_NAME}" == 'RF24Mesh' ]]; then
             rf24_deps=RF24Network
-          elif [[ $lib_name == 'RF24Ethernet' ]]; then
+          elif [[ "${REPO_NAME}" == 'RF24Ethernet' ]]; then
             rf24_deps='RF24Network;RF24Mesh'
           fi
-          echo "rf24-deps=$rf24_deps" >> $GITHUB_OUTPUT
+          echo "rf24-deps=$rf24_deps" >> "${GITHUB_OUTPUT}"
 
       - name: Install PlatformIO
-        run: |
-          python -m pip install --upgrade pip
-          pip install --upgrade platformio
+        run: pip install --upgrade platformio
 
       - name: Install extra dependencies
         if: inputs.lib-deps != ''
-        run: pio pkg install -g ${{ inputs.lib-deps }}
+        env:
+          LIB_DEPS: ${{ inputs.lib-deps }}
+        run: pio pkg install -g ${LIB_DEPS}
 
       - name: Install RF24Mesh library dependency
         if: contains(steps.lib-info.outputs.rf24-deps, 'RF24Mesh') && !endsWith(github.repository, 'RF24Mesh')
-        run: pio pkg install -g -f --skip-dependencies -l 'https://github.com/nRF24/RF24Mesh.git#${{ inputs.rf24mesh-ref }}'
+        env:
+          RF24MESH_REF: ${{ inputs.rf24mesh-ref }}
+        run: >-
+          pio pkg install -g -f --skip-dependencies
+          -l "https://github.com/nRF24/RF24Mesh.git#${RF24MESH_REF}"
 
       - name: Install RF24Network library dependency
         if: contains(steps.lib-info.outputs.rf24-deps, 'RF24Network') && !endsWith(github.repository, 'RF24Network')
-        run: pio pkg install -g -f --skip-dependencies -l 'https://github.com/nRF24/RF24Network.git#${{ inputs.rf24network-ref }}'
+        env:
+          RF24NETWORK_REF: ${{ inputs.rf24network-ref }}
+        run: >-
+          pio pkg install -g -f --skip-dependencies
+          -l "https://github.com/nRF24/RF24Network.git#${RF24NETWORK_REF}"
 
       - name: Install RF24 library dependency
         if: endsWith(github.repository, 'RF24') == false
-        run: pio pkg install -g -f --skip-dependencies -l 'https://github.com/nRF24/RF24.git#${{ inputs.rf24-ref }}'
+        env:
+          RF24_REF: ${{ inputs.rf24-ref }}
+        run: >-
+          pio pkg install -g -f --skip-dependencies
+          -l "https://github.com/nRF24/RF24.git#${RF24_REF}"
 
       - name: Run PlatformIO
-        run: pio ci --lib="." --board=${{ inputs.board-id }}
         env:
           PLATFORMIO_CI_SRC: ${{ inputs.example-path }}
+          BOARD: ${{ inputs.board-id }}
+        run: pio ci --lib="." --board="${BOARD}"
diff --git a/.github/workflows/bump_version_release.yaml b/.github/workflows/bump_version_release.yaml
index 51e85a7..03abb14 100644
--- a/.github/workflows/bump_version_release.yaml
+++ b/.github/workflows/bump_version_release.yaml
@@ -36,62 +36,72 @@ on:
 
 run-name: Deploying ${{ inputs.repo }} ${{ inputs.branch }}
 
+permissions: {}
+
 jobs:
   release-version-bump:
     runs-on: ubuntu-latest
+    # permissions required for secrets.BUMP_N_RELEASE token:
+    #   contents: write # to `git push` and create releases
+    #   pull-requests: read # to read PR info when regenerating the changelog
     steps:
-      - name: checkout ${{ inputs.repo }}
+      - name: Checkout ${{ inputs.repo }}
         uses: actions/checkout@v6
         with:
+          persist-credentials: true # needed for `git push`
           repository: nRF24/${{ inputs.repo }}
           ref: ${{ inputs.branch }}
           fetch-depth: 0
           path: ${{ inputs.repo }}
           token: ${{ secrets.BUMP_N_RELEASE }}
 
-      - name: checkout org repo
+      - name: Checkout org repo
         uses: actions/checkout@v6
         with:
+          persist-credentials: false
           path: org-repo
 
       - uses: actions/setup-python@v6
         with:
-          # here we need v3.10+
-          python-version: 3.x
-
-      - run: rustup update --no-self-update
-
-      - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@main
+          python-version: ">=3.10"
 
       - name: Install git-cliff
-        run: cargo binstall -y git-cliff --install-path org-repo
+        run: pip install -r org-repo/.github/requirements.txt
 
-      - name: increment version
+      - name: Increment version
         working-directory: ${{ inputs.repo }}
         id: inc-ver
+        env:
+          # needed by git-cliff to regenerate changelog
+          GITHUB_TOKEN: ${{ secrets.BUMP_N_RELEASE }}
+          BUMP_COMPONENT: ${{ inputs.bump-component }}
         run: >-
-          python "../org-repo/.github/workflows/increment_version.py"
-          --bump=${{ inputs.bump-component }}
+          python "../org-repo/.github/increment_version.py"
+          --bump="${BUMP_COMPONENT}"
           --update-metadata
 
-      - name: push metadata changes
+      - name: Push metadata changes
         working-directory: ${{ inputs.repo }}
         if: steps.inc-ver.outputs.made-changes == 'true'
+        env:
+          TAG: v${{ steps.inc-ver.outputs.new-version }}
         run: |-
           git config --global user.name "${GITHUB_ACTOR}"
           git config --global user.email "${GITHUB_ACTOR_ID}+${GITHUB_ACTOR}@users.noreply.github.com"
           git add --all
-          git commit -m "bump version to v${{ steps.inc-ver.outputs.new-version }}"
+          git commit -m "bump version to ${TAG}"
           git push
 
-      - name: publish release
+      - name: Publish release
         env:
           GH_TOKEN: ${{ secrets.BUMP_N_RELEASE }}
+          REPO: nRF24/${{ inputs.repo }}
+          BRANCH: ${{ inputs.branch }}
+          TAG: v${{ steps.inc-ver.outputs.new-version }}
+          NOTES: ${{ steps.inc-ver.outputs.release-notes }}
         run: >-
-          gh release create
-          v${{ steps.inc-ver.outputs.new-version }}
-          --notes-file ${{ steps.inc-ver.outputs.release-notes }}
-          --repo nRF24/${{ inputs.repo }}
-          --target ${{ inputs.branch }}
-          --title v${{ steps.inc-ver.outputs.new-version }}
+          gh release create "${TAG}"
+          --notes-file "${NOTES}"
+          --repo "${REPO}"
+          --target "${BRANCH}"
+          --title "${TAG}"
diff --git a/.github/workflows/cpp_lint.yaml b/.github/workflows/cpp_lint.yaml
index f8d2dd8..3c4c14d 100644
--- a/.github/workflows/cpp_lint.yaml
+++ b/.github/workflows/cpp_lint.yaml
@@ -12,11 +12,20 @@ on:
         type: string
         default: c,h,cpp,hpp
 
+permissions: {}
+
 jobs:
   cpp_linter:
     runs-on: ubuntu-latest
+    permissions:
+      # allow cpp-linter to post suggestions in PR reviews
+      pull-requests: write
+      # allow cpp-linter to detect which files changed
+      contents: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v6
         with:
           python-version: 3.x
@@ -24,18 +33,20 @@ jobs:
         run: sudo apt-get install clang-format-14
       - name: Install linter python package
         run: python3 -m pip install 'cpp-linter>=1.7.1'
-      - name: run linter as a python package
+      - name: Run cpp-linter (python package)
         id: linter
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          IGNORE: ${{ inputs.ignore }}
+          EXTENSIONS: ${{ inputs.extensions }}
         run: >-
           cpp-linter
           --version=14
           --style=file
           --tidy-checks='-*'
           --lines-changed-only=true
-          --extensions=${{ inputs.extensions }}
-          --ignore='${{ inputs.ignore }}'
+          --extensions=${EXTENSIONS}
+          --ignore="${IGNORE}"
           --format-review=true
           --file-annotations=false
           --step-summary=true
diff --git a/.github/workflows/deploy_cpack_artifacts.yaml b/.github/workflows/deploy_cpack_artifacts.yaml
new file mode 100644
index 0000000..76f694c
--- /dev/null
+++ b/.github/workflows/deploy_cpack_artifacts.yaml
@@ -0,0 +1,31 @@
+name: Upload release assets
+
+on:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  upload-assets:
+    runs-on: ubuntu-latest
+    permissions:
+      # needed to upload release assets
+      contents: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v6
+        with:
+          # This pattern downloads any artifacts built for armhf or arm64 targets.
+          # However, it also downloads artifacts built against pigpio and MRAA drivers.
+          pattern: pkg_${{ github.event.repository.name }}_arm*
+          path: artifacts
+          merge-multiple: true
+
+      - name: Upload Release assets
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        # Only upload artifacts that were built against RPi and SPIDEV drivers.
+        run: |-
+          files=$(ls artifacts/*RPi*.deb artifacts/*SPIDEV*.deb artifacts/*RPi*.rpm artifacts/*SPIDEV*.rpm)
+          gh release upload "${TAG}" ${files}
diff --git a/.github/workflows/deploy_docs.yaml b/.github/workflows/deploy_docs.yaml
new file mode 100644
index 0000000..9f48b2d
--- /dev/null
+++ b/.github/workflows/deploy_docs.yaml
@@ -0,0 +1,21 @@
+name: Deploy Docs
+
+on:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    permissions:
+      pages: write # to deploy to Pages
+      id-token: write # to verify the deployment originates from an appropriate source
+    steps:
+      - uses: actions/deploy-pages@v4
+        id: deployment
+        with:
+          artifact_name: ${{ github.event.repository.name }}_doxygen_docs
diff --git a/.github/workflows/deploy_platformio_artifact.yaml b/.github/workflows/deploy_platformio_artifact.yaml
new file mode 100644
index 0000000..d247ec6
--- /dev/null
+++ b/.github/workflows/deploy_platformio_artifact.yaml
@@ -0,0 +1,28 @@
+name: Validate and deploy PlatformIO
+
+on:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  deploy-platformio-asset:
+    runs-on: ubuntu-latest
+    permissions:
+      # needed to upload release assets
+      contents: write
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v6
+        with:
+          name: PIO_pkg_${{ github.event.repository.name }}
+          path: artifacts
+
+      - name: Upload Release assets
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |- 
+          files=$(ls artifacts/PlatformIO*.tar.gz)
+          gh release upload "${TAG}" ${files}
diff --git a/.github/workflows/lint_ci.yaml b/.github/workflows/lint_ci.yaml
new file mode 100644
index 0000000..b6327bf
--- /dev/null
+++ b/.github/workflows/lint_ci.yaml
@@ -0,0 +1,29 @@
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  lint-ci:
+    name: CI Workflows
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: 3.x
+
+      - name: Run zizmor
+        env:
+          # only used to relaxed rate limits; no special permissions needed
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: pipx run zizmor --format github ./
diff --git a/.github/workflows/vaildate_platformio.yaml b/.github/workflows/vaildate_platformio.yaml
new file mode 100644
index 0000000..85439c6
--- /dev/null
+++ b/.github/workflows/vaildate_platformio.yaml
@@ -0,0 +1,51 @@
+name: Package PlatformIO
+
+on:
+  workflow_call:
+    secrets:
+      PLATFORMIO_AUTH_TOKEN:
+        required: false
+
+permissions: {}
+
+jobs:
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: get lib info
+        id: lib-info
+        run: >-
+          echo "release=$(awk
+          -F "=" '/version/ {print $2}'
+          library.properties)" >> "${GITHUB_OUTPUT}"
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: 3.x
+
+      - name: Install PlatformIO
+        run: pip install --upgrade platformio
+
+      - name: package lib
+        env:
+          PIO_PKG_NAME: PlatformIO-${{ github.event.repository.name }}-${{ steps.lib-info.outputs.release }}.tar.gz
+        run: pio package pack -o "${PIO_PKG_NAME}"
+
+      - name: Save artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: PIO_pkg_${{ github.event.repository.name }}
+          path: PlatformIO*.tar.gz
+
+      - name: Upload package to PlatformIO Registry
+        # This step does not require any special github.token permissions.
+        # PIO lib packages cannot be re-published under the same tag.
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          PLATFORMIO_AUTH_TOKEN: ${{ secrets.PLATFORMIO_AUTH_TOKEN }}
+        run: pio package publish --owner nrf24 --non-interactive
diff --git a/.github/workflows/validate_deploy_platformio.yaml b/.github/workflows/validate_deploy_platformio.yaml
deleted file mode 100644
index a3ca1ec..0000000
--- a/.github/workflows/validate_deploy_platformio.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: Validate and deploy PlatformIO
-on:
-  workflow_call:
-    inputs:
-      deploy-release:
-        required: false
-        type: boolean
-    secrets:
-      PLATFORMIO_AUTH_TOKEN:
-        required: false
-
-jobs:
-  validate_lib_json:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: get lib info
-        id: lib-info
-        run: |
-          echo "name=$(echo ${{ github.repository }} | sed -e 's;.\+/;;')" >> $GITHUB_OUTPUT
-          echo "release=$(awk -F "=" '/version/ {print $2}' library.properties)" >> $GITHUB_OUTPUT
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: 3.x
-
-      - name: Install PlatformIO
-        run: |
-          python -m pip install --upgrade pip
-          pip install --upgrade platformio
-
-      - name: package lib
-        run: pio package pack -o PlatformIO-${{ steps.lib-info.outputs.name }}-${{ steps.lib-info.outputs.release }}.tar.gz
-
-      - name: Save artifact
-        uses: actions/upload-artifact@v5
-        with:
-          name: PIO_pkg_${{ steps.lib-info.outputs.name }}
-          path: PlatformIO*.tar.gz
-
-      - name: Upload Release assets
-        if: inputs.deploy-release
-        uses: shogo82148/actions-upload-release-asset@v1
-        with:
-          upload_url: ${{ github.event.release.upload_url }}
-          asset_path: "PlatformIO*.tar.gz"
-
-      - name: upload package to PlatformIO Registry
-        if: inputs.deploy-release
-        # PIO lib packages cannot be re-published under the same tag
-        env:
-          PLATFORMIO_AUTH_TOKEN: ${{ secrets.PLATFORMIO_AUTH_TOKEN }}
-        run: pio package publish --owner nrf24 --non-interactive
diff --git a/.gitignore b/.gitignore
index b248363..12e8b25 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
 
-.github/workflows/ReleaseNotes.md
+.github/ReleaseNotes.md