diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 39bfa3e..c677e03 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,9 +7,11 @@ on:
     branches: [ master ]
 
 jobs:
-  build:
+  matrix_build:
 
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     defaults:
       run:
         shell: bash
@@ -21,20 +23,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-20.04, macos-latest]
-        python-version: [3.7, 3.8, 3.9, '3.10']
+        os: [ubuntu-24.04, macos-latest, windows-latest]
+        python-version: [3.9, '3.10', '3.11', '3.12', '3.13']
     steps:
     - name: Set git crlf/eol
       run: |
         git config --global core.autocrlf false
         git config --global core.eol lf
 
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v5
       with:
-        submodules: True
+        fetch-depth: 0
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v5
       with:
         python-version: ${{ matrix.python-version }}
 
@@ -43,32 +45,8 @@ jobs:
         python -m pip install --upgrade pip
         pip install tox tox-gh-actions
 
-    - name: Install deps with apt helper action
-      uses: ryankurte/action-apt@v0.2.0
-      if: runner.os == 'Linux'
-      with:
-        # architectures to pass to dpkg --add-architecture
-        #architectures: # optional
-        packages: libusb-dev libusb-1.0.0-dev
-
     - name: Run tests
       run: |
         tox
       env:
         PLATFORM: ${{ matrix.os }}
-
-    - name: Check pkg builds
-      run: |
-        tox -e deploy
-
-    - name: Check wheel
-      run: |
-        tox -e check
-
-    - name: Build C tool
-      if: runner.os == 'Linux'
-      run: |
-        tox -e badge
-      env:
-        CC: 'gcc'
-        CXX: 'g++'
diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml
index 75040df..430fe25 100644
--- a/.github/workflows/pylint.yml
+++ b/.github/workflows/pylint.yml
@@ -9,7 +9,9 @@ on:
 jobs:
   pylint:
 
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     defaults:
       run:
         shell: bash
@@ -19,7 +21,9 @@ jobs:
       path: ${{ steps.analyze.outputs.path }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v5
+      with:
+        fetch-depth: 0
 
     - name: Extract base branch name
       id: extract_branch
@@ -34,17 +38,21 @@ jobs:
         else
             EXPORT_VALUE="${TMP_GITHUB_REF}"
         fi
-        echo "##[set-output name=branch;]${EXPORT_VALUE}"
+        echo "branch=${EXPORT_VALUE}" >> $GITHUB_OUTPUT
 
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v4
+    - name: Set up Python 3.10
+      uses: actions/setup-python@v5
       with:
-        python-version: 3.8
+        python-version: '3.10'
 
     - name: Install tox
       run: |
-        python -m pip install --upgrade pip wheel
-        pip install tox tox-gh-actions
+        python -m pip install --upgrade pip
+        pip install tox
+
+    #- name: Run tox bare-ass
+      #run: |
+        #tox -e lint
 
     - name: Run pylint
       id: analyze
@@ -53,36 +61,37 @@ jobs:
       run: |
         rating=$(bash -c 'tox -e lint' | grep 'Your code has been rated at' | cut -f7 -d " ")
         echo "Pylint score: ${rating}"
-        echo "##[set-output name=rating;]${rating}"
-        echo "##[set-output name=path;]${BADGE_PATH}"
+        echo "rating=${rating}" >> $GITHUB_OUTPUT
+        echo "path=${BADGE_PATH}" >> $GITHUB_OUTPUT
 
   badge:
     # Only generate and publish if these conditions are met:
     # - The previous job/analyze step ended successfully
     # - At least one of these is true:
-    #   - This is a push event and the push event is on branch 'master' or 'develop'
+    #   - This is a push event and the push event is on branch 'main' or 'develop'
     # Note: if this repo is personal (ie, not an org repo) then you can
     #       use the following to change the scope of the next 2 jobs
     #       instead of running on branch push as shown below:
     #   - This is a pull request event and the pull actor is the same as the repo owner
-    #     if: ${{ ( github.event_name == 'pull_request' && github.actor == github.repository_owner ) || github.ref == 'refs/heads/master' }}
+    #     if: ${{ ( github.event_name == 'pull_request' && github.actor == github.repository_owner ) || github.ref == 'refs/heads/main' }}
     name: Generate badge image with pylint score
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: read
+      contents: write
+      actions: read
     needs: [pylint]
     if: ${{ github.event_name == 'push' }}
-    #outputs:
-      #url: ${{ steps.url.outputs.url }}
-      #markdown: ${{ steps.url.outputs.markdown }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v5
       with:
         ref: badges
         path: badges
 
     # Use the output from the `analyze` step
     - name: Create pylint badge
-      uses: emibcn/badge-action@v1.2.4
+      uses: emibcn/badge-action@808173dd03e2f30c980d03ee49e181626088eee8  # v2.0.3
       id: badge
       with:
         label: 'Pylint score'
@@ -96,8 +105,8 @@ jobs:
         FILE: 'pylint-score.svg'
       working-directory: ./badges
       run: |
-        git config --local user.email "action@github.com"
-        git config --local user.name "GitHub Action"
+        git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
+        git config --local user.name "github-actions[bot]"
         mkdir -p "${BRANCH}"
         mv "${FILE}" "${BRANCH}"
         git add "${BRANCH}/${FILE}"
@@ -105,7 +114,7 @@ jobs:
         git commit -m "Add/Update badge" || true
 
     - name: Push badge commit
-      uses: ad-m/github-push-action@master
+      uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df  # v0.8.0
       with:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         branch: badges
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 61386fa..40e9fd6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,61 +1,26 @@
 name: Release
 
 on:
+  workflow_dispatch:
   push:
     # release on tag push
     tags:
       - '*'
 
-jobs:
-  wheels:
-
-    runs-on: ${{ matrix.os }}
-    defaults:
-      run:
-        shell: bash
-    env:
-      PYTHONIOENCODING: utf-8
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-20.04, macos-latest, windows-2019]
-        python-version: [3.7, 3.8, 3.9, '3.10']
-
-    steps:
-    - name: Set git crlf/eol
-      run: |
-        git config --global core.autocrlf false
-        git config --global core.eol lf
-
-    - uses: actions/checkout@v3
-      with:
-        fetch-depth: 0
-
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
-      with:
-        python-version: ${{ matrix.python-version }}
+permissions:
+  contents: write
 
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip wheel
-        pip install tox tox-gh-actions
-
-    - name: Build dist pkgs
-      run: |
-        tox -e deploy
-
-    - name: Upload artifacts
-      if: matrix.python-version == 3.8 && runner.os != 'Windows'
-      uses: actions/upload-artifact@v3
-      with:
-        name: wheels
-        path: ./dist/*.whl
+jobs:
+  build_wheels:
+    name: Build wheels
+    permissions:
+      contents: read
+    uses: ./.github/workflows/wheels.yml
 
   create_release:
     name: Create Release
-    needs: [wheels]
-    runs-on: ubuntu-20.04
+    needs: [build_wheels, build_docs]
+    runs-on: ubuntu-22.04
 
     steps:
       - name: Get version
@@ -64,21 +29,26 @@ jobs:
           echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_ENV
           echo ${{ env.VERSION }}
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       # download all artifacts to project dir
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v5
+
+      - name: check artifacts
+        run: |
+          ls -l packages/
 
       - name: Generate changes file
-        uses: sarnold/gitchangelog-action@master
+        uses: sarnold/gitchangelog-action@915234f151ceffb7a8c4f76de77e4ae321087b8f  # v1.1.1
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN}}
 
       - name: Create release
         id: create_release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8  # v2.3.2
+        if: startsWith(github.ref, 'refs/tags/')
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -88,4 +58,5 @@ jobs:
           draft: false
           prerelease: false
           files: |
-            wheels/cp210x*.whl
+            packages/*.whl
+            packages/*.tar.gz
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index b22a832..1ce69f8 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -2,24 +2,29 @@ name: Wheels
 
 on:
   workflow_dispatch:
+  workflow_call:
   pull_request:
   push:
     branches: [ master ]
 
 jobs:
-  build:
+  python_wheels:
 
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     defaults:
       run:
         shell: bash
     env:
+      PYTHON: ${{ matrix.python-version }}
       PYTHONIOENCODING: utf-8
+      PIP_DOWNLOAD_CACHE: ${{ github.workspace }}/../.pip_download_cache
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-20.04, macos-latest, windows-2019]
-        python-version: [3.7, 3.8, 3.9, '3.10']
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: [3.9, '3.10', '3.11', '3.12', '3.13']
 
     steps:
       - name: Set git crlf/eol
@@ -27,57 +32,27 @@ jobs:
           git config --global core.autocrlf false
           git config --global core.eol lf
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip wheel
-          pip install tox tox-gh-actions
+          python -m pip install --upgrade pip
+          pip install tox
 
       - name: Build dist pkgs
         run: |
-          tox -e deploy
+          tox -e build,check
 
       - name: Upload artifacts
-        if: matrix.python-version == 3.8 && runner.os == 'Linux'
-        uses: actions/upload-artifact@v3
+        if: matrix.python-version == 3.9 && runner.os == 'Linux'
+        uses: actions/upload-artifact@v4
         with:
-          name: wheels
-          path: ./dist/*.whl
-
-  check_artifact:
-    name: Check wheel artifact
-    needs: [build]
-    runs-on: ${{ matrix.os }}
-    defaults:
-      run:
-        shell: bash
-    env:
-      PYTHONIOENCODING: utf-8
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-2019]
-        python-version: [3.8, '3.10']
-
-    steps:
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
-        with:
-          python-version: ${{ matrix.python-version }}
-
-      # download all artifacts to project dir
-      - uses: actions/download-artifact@v3
-
-      - name: Check wheel install
-        run: |
-          pip install pyusb
-          bash -c 'export WHL=$(ls wheels/*.whl); python -m pip install $WHL'
-          cp210x-program.py --version
+          name: packages
+          path: dist
diff --git a/requirements.txt b/requirements.txt
index 38e3065..888e45a 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,2 @@
-hexdump @ https://github.com/sarnold/hexdump/releases/download/3.4.0/hexdump-3.4.0-py3-none-any.whl
+hexdump @ https://github.com/sarnold/hexdump/releases/download/3.5.3/hexdump-3.5.3-py3-none-any.whl
 pyusb
diff --git a/setup.py b/setup.py
index 87863ca..ae4e653 100755
--- a/setup.py
+++ b/setup.py
@@ -28,15 +28,17 @@
     url="https://github.com/VCTLabs/cp210x-program",
     platforms="POSIX",
     classifiers=[
-        "License :: OSI-Approved Open Source :: GNU Library or Lesser General Public License (LGPL)",
-        "Intended Audience :: Manufacturing",
         "Development Status :: 4 - Beta",
+        "Intended Audience :: Manufacturing",
         "Topic :: System :: Hardware :: Hardware Drivers",
         "Programming Language :: Python",
         "Operating System :: POSIX :: Linux",
         "Operating System :: POSIX :: BSD :: FreeBSD",
         "Operating System :: MacOS :: MacOS X",
     ],
+    install_requires =[
+        'pyusb'
+    ],
     packages=[
         'cp210x'
     ],
diff --git a/tox.ini b/tox.ini
index e49481e..1713cf2 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,48 +1,68 @@
 [tox]
-envlist = py{36,37,38,39}-{linux,macos,windows}
+envlist = py3{9,10,11,12,13}-{linux,macos,windows}
 skip_missing_interpreters = true
 isolated_build = true
 skipsdist = True
 
 [gh-actions]
 python =
-    3.6: py36
-    3.7: py37
-    3.8: py38
     3.9: py39
+    3.10: py310
+    3.11: py311
+    3.12: py312
+    3.13: py313
 
 [gh-actions:env]
 PLATFORM =
-    ubuntu-20.04: linux
+    ubuntu-latest: linux
     macos-latest: macos
-    windows-2019: windows
+    windows-latest: windows
+
+[base]
+deps =
+    pip>=23.1
+    setuptools_scm[toml]
+
+[build]
+deps =
+    pip>=23.1
+    build
+    twine
 
 [testenv]
+description =
+    Default test environment for Python version/gh-action test matrix
+
 passenv =
     pythonLocation
     CI
     PYTHONIOENCODING
     PIP_DOWNLOAD_CACHE
 
-setenv = PYTHONPATH = {toxinidir}
+#setenv = PYTHONPATH = {toxinidir}
 
 allowlist_externals =
     bash
     diff
 
 deps =
-    pip>=20.3
-    -rrequirements.txt
+    {[base]deps}
+    -r requirements.txt
     pytest
     -e .
 
 commands =
     # first generate some test output for pytest
-    cp210x-program.py -pc -F testdata/cp2102-orig.hex -f testdata/test.out
+    bash -c 'cp210x-program.py -pc -F testdata/cp2102-orig.hex -f testdata/test.out'
     bash -c 'cp210x-program.py -pc -F testdata/cp2102-orig.hex > testdata/test2.out'
     pytest -v --capture=no test_platform_data.py
 
 [testenv:lint]
+skip_install = true
+
+description =
+    Linting environment using Pylint with normal pip install
+
 passenv =
     pythonLocation
     CI
@@ -50,15 +70,19 @@ passenv =
     PIP_DOWNLOAD_CACHE
 
 deps =
-    pip>=20.3
+    {[base]deps}
     pylint
     -rrequirements.txt
 
 commands =
     pylint --fail-under=7 cp210x/ scripts/
 
-[testenv:deploy]
+[testenv:build]
 skip_install = true
+always_copy = False
+
+description =
+    PEP517 package build and metadata check
 
 passenv =
     pythonLocation
@@ -67,35 +91,37 @@ passenv =
     PIP_DOWNLOAD_CACHE
 
 deps =
-    pip>=20.3
-    wheel
-    twine
+    {[build]deps}
 
 commands =
-    python setup.py sdist
-    python setup.py bdist_wheel
+    python -m build .
     twine check dist/*
 
 [testenv:check]
+skip_install = true
+always_copy = False
+
+description =
+    Install check for built wheel package (clean venv with no extra deps)
+
 passenv =
     PYTHON
     pythonLocation
     CI
+    GITHUB*
     PYTHONIOENCODING
     PIP_DOWNLOAD_CACHE
-skip_install = true
 
 allowlist_externals =
     bash
 
 deps =
-    pip>=20.3
-    -rrequirements.txt
+    pip>=23.1
 
 commands =
-    bash -c 'export WHL_FILE=$(ls dist/*.whl); \
-        python -m pip install --force-reinstall $WHL_FILE'
-    cp210x-program.py --version
+    bash -c 'python -m pip install dist/*.whl --force-reinstall --prefer-binary'
+    python -m pip show -f cp210x_program
+    bash -c 'cp210x-program.py --version'
 
 [testenv:readhex]
 passenv =
@@ -108,13 +134,10 @@ allowlist_externals =
     bash
 
 deps =
-    pip>=20.3
-    -rrequirements.txt
+    pip>=23.1
 
 commands =
-    bash -c 'export WHL_FILE=$(ls dist/*.whl); \
-        python -m pip install --force-reinstall $WHL_FILE'
-    #bash -c 'cp210x-program.py --read-cp210x || echo true'
+    bash -c 'python -m pip install dist/*.whl --force-reinstall --prefer-binary'
     cp210x-program.py --read-cp210x -f readhex.out
 
 [testenv:read]
@@ -128,7 +151,7 @@ allowlist_externals =
     bash
 
 deps =
-    pip>=20.3
+    pip>=23.1
     -rrequirements.txt
 
 commands =
@@ -151,7 +174,7 @@ allowlist_externals =
     cp
 
 deps =
-    pip>=20.3
+    pip>=23.1
     this-cli
     -rrequirements.txt
 
@@ -180,4 +203,4 @@ deps =
     pip>=20.3
 
 commands =
-    bash -c 'rm -rf ./ext/badge/bin'
+    bash -c 'rm -rf ./ext/badge/bin __pycache__ cp210x_program.egg-info dist'