@dependably/npm-check 1.7.1 → 1.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/package.json +1 -1
  2. package/src/audit-config.js +1 -1
  3. package/src/audit.js +1 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@dependably/npm-check",
3
- "version": "1.7.1",
3
+ "version": "1.8.0",
4
4
  "description": "A comprehensive tool for validating, migrating, and updating npm package-lock.json files across versions 1, 2, and 3.",
5
5
  "main": "src/index.js",
6
6
  "type": "module",
package/src/audit-config.js CHANGED
@@ -58,7 +58,7 @@ export const DEFAULT_CONFIG = {
58
58
  'install-scripts': ['warn', { allow: [] }],
59
59
  'no-git-deps': 'warn',
60
60
  'no-remote-deps': ['warn', { allowedHosts: ['registry.npmjs.org', 'npm.pkg.github.com'] }],
61
- 'pinned-versions': ['warn', {
61
+ 'pinned-versions': ['error', {
62
62
  sections: ['dependencies', 'devDependencies', 'optionalDependencies'],
63
63
  ignore: []
64
64
  }],
package/src/audit.js CHANGED
@@ -361,7 +361,7 @@ function collectUnpinnedOverrides(overrides, lockfile, section, ignore, pinHint)
361
361
  const pinnedVersionsRule = {
362
362
  id: 'pinned-versions',
363
363
  description: 'package.json dependency ranges must be exact versions',
364
- defaultSeverity: 'warn',
364
+ defaultSeverity: 'error',
365
365
  // package.json pinning is manifest-level and flavor-agnostic — pnpm projects
366
366
  // should pin too, and this is what makes the pnpm.overrides flagging below
367
367
  // actually reachable on a pnpm-lock.yaml (the `lockfile.packages` lookups are