diff --git a/.changeset/breezy-suits-explain.md b/.changeset/breezy-suits-explain.md
new file mode 100644
index 00000000..b6a7de0b
--- /dev/null
+++ b/.changeset/breezy-suits-explain.md
@@ -0,0 +1,11 @@
+---
+'@wayofdev/eslint-config-bases': patch
+'@wayofdev/commitlint-config': patch
+'@wayofdev/secretlint-config': patch
+'@wayofdev/stylelint-config': patch
+'@wayofdev/htmlhint-config': patch
+'@wayofdev/tsconfig-config': patch
+'@wayofdev/postcss-config': patch
+---
+
+fix: dependency updates, workflow changes
diff --git a/.github/workflows/ci-packages.yml b/.github/workflows/ci-packages.yml
index 33de84dc..08d70d92 100644
--- a/.github/workflows/ci-packages.yml
+++ b/.github/workflows/ci-packages.yml
@@ -1,6 +1,6 @@
 ---
-
 on: # yamllint disable-line rule:truthy
+  merge_group:
   push:
     branches:
       - master
@@ -24,18 +24,6 @@ on: # yamllint disable-line rule:truthy
       - 'pnpm*'
       - '.github/**'
 
-  merge_group:
-    types:
-      - opened
-      - synchronize
-      - reopened
-    # Only consider those paths to trigger the action
-    paths:
-      - 'packages/**'
-      - 'package.json'
-      - 'pnpm*'
-      - '.github/**'
-
 name: 🔍 Continuous integration for packages
 
 jobs:
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index bcfa96df..87315b68 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -1,6 +1,5 @@
 ---
-
-on:  # yamllint disable-line rule:truthy
+on: # yamllint disable-line rule:truthy
   pull_request:
 
 name: 🐞 Differential shell-check
@@ -11,6 +10,13 @@ permissions:
 jobs:
   shellcheck:
     runs-on: ubuntu-latest
+    permissions:
+      # required for all workflows
+      security-events: write
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
     steps:
       - name: 📦 Check out the codebase
         uses: actions/checkout@v3
@@ -18,9 +24,15 @@ jobs:
           fetch-depth: 0
 
       - name: 🐞 Differential shell-check
+        id: shellcheck
         uses: redhat-plumbers-in-action/differential-shellcheck@v4
         with:
           severity: warning
           token: ${{ secrets.GITHUB_TOKEN }}
 
-...
+      - if: ${{ always() }}
+        name: 📤 Upload artifact with shell-check defects in SARIF format
+        uses: actions/upload-artifact@v3
+        with:
+          name: Differential shell-check SARIF
+          path: ${{ steps.shellcheck.outputs.sarif }}
diff --git a/Makefile b/Makefile
index ef50b68f..0969a5c7 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,11 @@ DOCKER_COMPOSE ?= docker-compose
 # Support image with all needed binaries, like envsubst, mkcert, wait4x
 SUPPORT_IMAGE ?= wayofdev/build-deps:alpine-latest
 
-BUILDER_PARAMS ?= docker run --rm -i -v $(shell pwd):/home/wod
+BUILDER_PARAMS ?= docker run \
+	--rm \
+	-i \
+	-v $(PWD):/app \
+	--workdir /app
 
 BUILDER ?= $(BUILDER_PARAMS) $(SUPPORT_IMAGE)
 NPM_BIN ?= pnpm
@@ -150,6 +154,10 @@ lint-actions: ## Lint github actions using actionlint
 	$(BUILDER) actionlint -color
 .PHONY: lint-actions
 
+lint-types: ## Run typecheck
+	$(NPM_BIN) lint:types
+.PHONY: lint-types
+
 test: ## Run unit tests
 	$(NPM_BIN) test
 .PHONY: test
diff --git a/packages/commitlint-config/lint-staged.config.js b/packages/commitlint-config/lint-staged.config.js
index d3ffa381..603c338b 100644
--- a/packages/commitlint-config/lint-staged.config.js
+++ b/packages/commitlint-config/lint-staged.config.js
@@ -1,5 +1,3 @@
-// @ts-check
-
 /**
  * This files overrides the base lint-staged.config.js present in the root directory.
  * It allows to run eslint based the package specific requirements.
diff --git a/packages/eslint-config-bases/package.json b/packages/eslint-config-bases/package.json
index 150f004f..2c40e50a 100644
--- a/packages/eslint-config-bases/package.json
+++ b/packages/eslint-config-bases/package.json
@@ -159,7 +159,7 @@
     "@wayofdev/lint-staged-config": "workspace:*",
     "eslint": "8.36.0",
     "graphql": "16.6.0",
-    "prettier": "2.8.3 || >= 3.0.0-alpha.4",
+    "prettier": "2.8.4",
     "react": "18.2.0",
     "react-dom": "18.2.0",
     "tailwindcss": "3.2.7",
diff --git a/packages/htmlhint-config/package.json b/packages/htmlhint-config/package.json
index 1c9bf12d..1891af63 100644
--- a/packages/htmlhint-config/package.json
+++ b/packages/htmlhint-config/package.json
@@ -29,8 +29,7 @@
   "scripts": {
     "clean": "rimraf ./dist ./coverage ./tsconfig.tsbuildinfo",
     "lint": "eslint --ext .json --cache --cache-location ../../.cache/eslint/htmlhint-config.eslintcache",
-    "lint:fix": "eslint --ext .json --fix --cache --cache-location ../../.cache/eslint/htmlhint-config.eslintcache",
-    "lint:types": "tsc --project tsconfig.json --noEmit"
+    "lint:fix": "eslint --ext .json --fix --cache --cache-location ../../.cache/eslint/htmlhint-config.eslintcache"
   },
   "devDependencies": {
     "@wayofdev/lint-staged-config": "workspace:*",
diff --git a/packages/secretlint-config/package.json b/packages/secretlint-config/package.json
index 10a70595..d776aa42 100644
--- a/packages/secretlint-config/package.json
+++ b/packages/secretlint-config/package.json
@@ -30,8 +30,7 @@
   "scripts": {
     "clean": "rimraf ./dist ./coverage ./tsconfig.tsbuildinfo",
     "lint": "eslint --ext .js --cache --cache-location ../../.cache/eslint/secretlint-config.eslintcache",
-    "lint:fix": "eslint --ext .js --fix --cache --cache-location ../../.cache/eslint/secretlint-config.eslintcache",
-    "lint:types": "tsc --project tsconfig.json --noEmit"
+    "lint:fix": "eslint --ext .js --fix --cache --cache-location ../../.cache/eslint/secretlint-config.eslintcache"
   },
   "dependencies": {
     "@secretlint/secretlint-rule-preset-recommend": "6.2.3"
diff --git a/packages/stylelint-config/lint-staged.config.js b/packages/stylelint-config/lint-staged.config.js
index cc4917da..0d3146a7 100644
--- a/packages/stylelint-config/lint-staged.config.js
+++ b/packages/stylelint-config/lint-staged.config.js
@@ -1,5 +1,3 @@
-// @ts-check
-
 /**
  * This files overrides the base lint-staged.config.js present in the root directory.
  * It allows to run eslint based the package specific requirements.
diff --git a/packages/tsconfig-config/package.json b/packages/tsconfig-config/package.json
index cf566e7e..4b3058dd 100644
--- a/packages/tsconfig-config/package.json
+++ b/packages/tsconfig-config/package.json
@@ -35,7 +35,7 @@
     "lint:fix": "eslint --ext .ts,.tsx,.js,.jsx,.mjs,.cjs,.mts,.cts --fix --cache --cache-location ../../.cache/eslint/tsconfig-config.eslintcache"
   },
   "peerDependencies": {
-    "typescript": ">= 4"
+    "typescript": "^4.9 || ^5"
   },
   "publishConfig": {
     "access": "public"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f3766d17..80088103 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -287,7 +287,7 @@ importers:
 
   packages/tsconfig-config:
     specifiers:
-      typescript: '>= 4'
+      typescript: ^4.9 || ^5
     dependencies:
       typescript: 5.0.2
 
@@ -829,7 +829,7 @@ packages:
       lodash.merge: 4.6.2
       lodash.uniq: 4.5.0
       resolve-from: 5.0.0
-      ts-node: 10.9.1_sxidjv3cojnrggmso45tj7hldi
+      ts-node: 10.9.1_cbfmry4sbbh4vatmdrsmatfg5a
       typescript: 4.9.5
     transitivePeerDependencies:
       - '@swc/core'
@@ -2971,7 +2971,7 @@ packages:
     dependencies:
       '@types/node': 18.15.3
       cosmiconfig: 8.1.1
-      ts-node: 10.9.1_sxidjv3cojnrggmso45tj7hldi
+      ts-node: 10.9.1_cbfmry4sbbh4vatmdrsmatfg5a
       typescript: 4.9.5
 
   /cosmiconfig/7.1.0:
@@ -8130,7 +8130,7 @@ packages:
     engines: {node: '>=6.10'}
     dev: false
 
-  /ts-node/10.9.1_sxidjv3cojnrggmso45tj7hldi:
+  /ts-node/10.9.1_cbfmry4sbbh4vatmdrsmatfg5a:
     resolution: {integrity: sha512-NtVysVPkxxrwFGUUxGYhfux8k78pQB3JqYBXlLRZgdGUqTO5wU/UyHop5p70iEbGhB7q5KmiZiU0Y3KlJrScEw==}
     hasBin: true
     peerDependencies:
@@ -8156,7 +8156,7 @@ packages:
       create-require: 1.1.1
       diff: 4.0.2
       make-error: 1.3.6
-      typescript: 5.0.2
+      typescript: 4.9.5
       v8-compile-cache-lib: 3.0.1
       yn: 3.1.1
 
diff --git a/renovate.json b/renovate.json
index ffd6697a..17f10b54 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,8 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:base"
-  ],
+  "extends": ["config:base"],
+  "prHourlyLimit": 0,
   "automerge": true,
   "platformAutomerge": true,
   "lockFileMaintenance": {
@@ -14,10 +13,7 @@
   "packageRules": [
     {
       "description": "Automerge non-major updates",
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
+      "matchUpdateTypes": ["minor", "patch"],
       "automerge": true,
       "platformAutomerge": true
     }