diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 7035569a..23a45a50 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -39,8 +39,9 @@ jobs:
         env:
           PRERELEASE: ${{ github.event.release.prerelease }}
         run: |
-          if [ "$PRERELEASE" = "true" ]; then
-            npm publish corebc-*.tgz --access public --provenance --tag next
+          VERSION=$(node --print 'JSON.parse(require("node:fs").readFileSync("package.json", "utf8")).version')
+          if [ "$PRERELEASE" = "true" ] || [[ "$VERSION" == *-* ]]; then
+            npm publish corebc-*.tgz --access public --provenance --tag rc
           else
             npm publish corebc-*.tgz --access public --provenance --tag latest
           fi
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cedb5850..d6d5b1db 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -27,8 +27,10 @@ Open a pull request explaining the problem, changed behavior, and validation. Bu
 
 1. Update `package.json` and `src.ts/_version.ts` to the intended version, install dependencies with `npm install`, and document changes in `CHANGELOG.md`.
 2. Run `npm run check` and commit source, configuration, and documentation changes.
-3. Create a GitHub release whose tag is the version, optionally prefixed with `v`.
+3. Create a GitHub release whose tag is the version, optionally prefixed with `v`. Select the branch containing that version as the release target; any branch is supported and must contain the release workflow.
 
-The release workflow checks the tag against the package version, reruns validation and the dependency audit, and publishes the validated npm archive with provenance. Both workflows use `npm install` with package-manager caching disabled; npm creates an ephemeral runner lockfile for the dependency audit. GitHub prereleases use the `next` dist-tag; normal releases use `latest`.
+The release workflow checks the tag against the package version, reruns validation and the dependency audit, and publishes the validated npm archive with provenance. Both workflows use `npm install` with package-manager caching disabled; npm creates an ephemeral runner lockfile for the dependency audit. GitHub pre-releases and versions with a pre-release suffix use the `rc` dist-tag; stable releases use `latest`.
+
+For example, to publish a release candidate from `any-branch`, set both version files to `1.1.2-rc.1` on that branch and commit the changes. Create a GitHub release with tag `1.1.2-rc.1` (or `v1.1.2-rc.1`), target `any-branch`, select **Pre-release**, and publish it. Publishing the release triggers npm publication, including when publishing a saved draft; merely creating a tag or saving a draft does not. Install the candidate with `npm install corebc@rc` or `npm install corebc@1.1.2-rc.1`. The npm `latest` tag stays unchanged.
 
 Before the first automated release, a package owner must configure an npm trusted publisher for `CorePass/corebc.js`, workflow `publish-npm.yml`. This is an npm account setting, not a repository secret. See [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/). Publishing a GitHub release triggers publication; CI on pull requests does not publish.
diff --git a/package.json b/package.json
index 1fc35a0d..b615da0b 100644
--- a/package.json
+++ b/package.json
@@ -15,17 +15,17 @@
 	},
 	"dependencies": {
 		"@noble/hashes": "2.4.0",
-		"@types/node": "26.4.1",
+		"@types/node": "26.6.5",
 		"aes-js": "3.1.2",
 		"bcrypto": "^5.5.2",
 		"bn.js": "^5.2.5",
 		"buffer": "^6.0.3",
 		"tslib": "2.8.1",
 		"utf8": "^3.0.0",
-		"ws": "8.21.3"
+		"ws": "8.22.0"
 	},
 	"devDependencies": {
-		"@rollup/plugin-commonjs": "^29.0.0",
+		"@rollup/plugin-commonjs": "^29.0.3",
 		"@rollup/plugin-inject": "^5.0.5",
 		"@rollup/plugin-node-resolve": "16.0.3",
 		"@types/bn.js": "^5.2.0",
@@ -33,9 +33,9 @@
 		"@types/semver": "7.8.0",
 		"@types/utf8": "^3.0.3",
 		"c8": "12.0.0",
-		"mocha": "12.0.0",
-		"prettier": "^3.9.6",
-		"rollup": "4.63.1",
+		"mocha": "12.0.3",
+		"prettier": "^3.9.10",
+		"rollup": "4.65.0",
 		"semver": "7.8.5",
 		"typescript": "7.0.2",
 		"uglify-js": "3.19.3"
@@ -105,8 +105,7 @@
 	"main": "./lib.commonjs/index.js",
 	"module": "./lib.esm/index.js",
 	"publishConfig": {
-		"access": "public",
-		"tag": "latest"
+		"access": "public"
 	},
 	"scripts": {
 		"_build-dist": "rollup -c && uglifyjs ./dist/corebc.js -o ./dist/corebc.min.js && uglifyjs ./dist/corebc.umd.js -o ./dist/corebc.umd.min.js && uglifyjs ./dist/wordlists-extra.js -o ./dist/wordlists-extra.min.js",