search

stylelint / eslint-config-stylelint

Stylelint org's shareable config for eslint
MIT License
59 stars 9 forks source link

Bump eslint-plugin-regexp from 1.1.0 to 1.3.1 #147

Closed dependabot[bot] closed 2 years ago

dependabot[bot] commented 2 years ago

Bumps eslint-plugin-regexp from 1.1.0 to 1.3.1.

Release notes

Sourced from eslint-plugin-regexp's releases.

v1.3.1

:bug: Bug Fixes

  • #338 Fixed autofix not working for unknown patterns in regexp/sort-flags rule.

v1.3.0

:bug: Bug Fixes

  • #335 Fixed false negatives in regexp/no-useless-lazy rule.

v1.2.0

✨ Enhancements

  • #319 Added regexp/no-contradiction-with-assertion rule.
  • #324 Added regexp/prefer-lookaround rule.
  • #329 Added regexp/no-empty-character-class rule.
  • #330 Added regexp/prefer-named-capture-group rule.
  • #331 Added regexp/require-unicode-regexp rule.
  • #332 Added regexp/no-misleading-unicode-character rule.
  • #333 Added regexp/no-control-character rule.
  • #316 Improved regexp/no-useless-assertion rule for nested assertions.

:bug: Bug Fixes

  • #327 Fixed false negatives for regex in RegExp constructor in regexp/control-character-escape rule.
  • #320, #321 Improved regexp/sort-alternative's comparison function.
Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
ybiquitous commented 2 years ago

Incidentally, has dependabot changed recently so that it only updates the package-lock.json, rather than the package.json as well?

Umm..., I'm not sure. 🤷🏼

Maybe, it seems necessary to change versioning-strategy: widen to versioning-strategy: increase like the stylelint/stylelint repo:

https://github.com/stylelint/eslint-config-stylelint/blob/3ddb7cde414bbbf5319e80a044ee0c3bfd542e4b/.github/dependabot.yml#L8

https://github.com/stylelint/stylelint/blob/864b01beed919bfc4317ec538e816ac49042ed82/.github/dependabot.yml#L10

jeddy3 commented 2 years ago

Do you happen to know which of those two strategies is best practice? We should use that consistently across repos.

ybiquitous commented 2 years ago

According to the Dependabot document, if we'd like to update both package.json and package-lock.json, it seems necessary to set versioning-strategy: increase.

ybiquitous commented 2 years ago

FYI. https://github.com/search?q=org%3Astylelint+%27versioning-strategy%27&type=code

jeddy3 commented 2 years ago

FYI. https://github.com/search?q=org%3Astylelint+%27versioning-strategy%27&type=code

About 50/50 then :)

versioning-strategy When Dependabot edits a manifest file to update a version, it uses the following overall strategies:

  • For apps, the version requirements are increased, for example: npm, pip and Composer.
  • For libraries, the range of versions is widened, for example: Bundler and Cargo.

It sounds like we can just remove the config versioning-strategy property, and it'll default to increase which is what we want?

ybiquitous commented 2 years ago

It sounds like we can just remove the config versioning-strategy property, and it'll default to increase which is what we want?

I am not sure, but I remember that when omitting versioning-strategy, it did not work as I expected. 🤔 But it might be worth a try!

jeddy3 commented 2 years ago

Let's give it a go in this repo. We can always explicitly set increase next month if it doesn't work.

dependabot[bot] commented 2 years ago

Superseded by #149.