commit-sheriff 1.6.0 → 1.6.2

package/README.md

@@ -247,13 +247,19 @@ The default config added by `init` (only if you don't already have one):
 ```json
 {
   "lint-staged": {
-    "*.{js,jsx,ts,tsx}": ["eslint --fix", "prettier --write"],
+    "*.{js,jsx,ts,tsx}": ["eslint --fix --max-warnings=0", "prettier --write"],
     "*.{json,md,css,scss,html}": ["prettier --write"]
   }
 }
 ```
 
-Adjust freely — `commit-sheriff` doesn't overwrite it once present.
+`--max-warnings=0` is there on purpose: ESLint only fails (non-zero exit) on errors by default, so
+a rule set to `"warn"` (e.g. many "recommended" configs' default severity for unused imports) would
+otherwise print in the terminal but still let the commit through looking clean.
+
+Adjust freely — `commit-sheriff` doesn't overwrite it once present. That also means this default
+only lands on **new** setups; if your project already has a `lint-staged` block from before this
+change, add `--max-warnings=0` to it by hand to get the same behavior.
 
 ## Advanced: ESLint module-boundary template (TypeScript/React)
 
@@ -304,16 +310,22 @@ It installs whatever it needs automatically (via `npm install --save-dev`, same
 `lint-staged`/`eslint`/`prettier`), skipping anything already present:
 
 ```bash
-npm install --save-dev eslint@^9 typescript @typescript-eslint/parser \
-  @typescript-eslint/eslint-plugin @eslint/js @eslint/eslintrc eslint-plugin-sonarjs \
+npm install --save-dev eslint@^9 typescript@^5 @typescript-eslint/parser \
+  @typescript-eslint/eslint-plugin @eslint/js@^9 @eslint/eslintrc eslint-plugin-sonarjs \
   eslint-plugin-import eslint-plugin-prettier eslint-config-prettier eslint-plugin-react \
   eslint-plugin-react-hooks eslint-plugin-jsx-a11y eslint-plugin-testing-library \
   @vitest/eslint-plugin eslint-plugin-jest prettier
 ```
 
-`eslint` is pinned to `^9` on purpose rather than left to resolve to whatever `latest` is — plugins
-like `eslint-plugin-react` have historically taken a while to support each new ESLint major, so an
-unpinned install can grab a version the rest of the toolchain doesn't work with yet.
+`eslint`, `@eslint/js`, and `typescript` are pinned on purpose rather than left to resolve to
+whatever `latest` is — the plugin ecosystem here regularly lags behind both. Two concrete
+conflicts this has already caused: `@eslint/js`'s own `latest` declares a hard peer on
+`eslint@^10`, so leaving it unpinned next to `eslint@^9` is an instant `ERESOLVE`; and
+`@typescript-eslint/eslint-plugin` currently only supports `typescript` up to `<6.1.0`, so an
+unpinned `typescript` install (which resolves to its own `latest`, e.g. `7.x`) crashes plugin
+loading with "typescript-eslint does not support TS 7.0". Pinning `eslint`/`@eslint/js` together
+to `^9` and `typescript` to `^5` keeps the whole toolchain on versions that are actually
+compatible with each other today.
 
 If the install fails (offline, registry issue, etc.), it prints this exact command so you can run
 it yourself.

package/bin/commit-sheriff.js

@@ -38,7 +38,10 @@ const DEFAULT_COMMIT_GUARD = {
 };
 
 const DEFAULT_LINT_STAGED = {
-  "*.{js,jsx,ts,tsx}": ["eslint --fix", "prettier --write"],
+  // --max-warnings=0: without this, ESLint only fails (non-zero exit) on errors — a warning
+  // (e.g. many "recommended" configs' default severity for unused imports) prints in the
+  // terminal but still lets `eslint --fix` exit 0, so the commit goes through looking clean.
+  "*.{js,jsx,ts,tsx}": ["eslint --fix --max-warnings=0", "prettier --write"],
   "*.{json,md,css,scss,html}": ["prettier --write"],
 };
 
@@ -199,11 +202,19 @@ function init() {
 const ESLINT_REACT_DEV_DEPS = [
   // Pinned (not left to resolve to "latest") — see the comment on the eslint@^9 install in
   // mergeConfig() for why: the plugin ecosystem here regularly lags behind ESLint's newest major.
+  // @eslint/js in particular is versioned in lockstep with ESLint core and its `latest` (10.x)
+  // declares a hard peerDependency on eslint@^10 — installing it unpinned alongside eslint@^9
+  // produces an immediate ERESOLVE conflict, which is exactly what this pin prevents.
   "eslint@^9",
-  "typescript",
+  // Same lag problem, different package: @typescript-eslint/eslint-plugin@8.65.0 declares
+  // `typescript: ">=4.8.4 <6.1.0"` as a peer, but unpinned "typescript" resolves to npm's
+  // "latest" (7.x once TypeScript ships a 7.0) — that's outside the supported range and
+  // crashes plugin loading with "typescript-eslint does not support TS 7.0". Pinning to the
+  // latest 5.x line keeps us inside the range the plugin actually supports today.
+  "typescript@^5",
   "@typescript-eslint/parser",
   "@typescript-eslint/eslint-plugin",
-  "@eslint/js",
+  "@eslint/js@^9",
   "@eslint/eslintrc",
   "eslint-plugin-sonarjs",
   "eslint-plugin-import",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commit-sheriff",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "Shared husky commit-msg / pre-commit hooks enforcing ticket-based commit messages and branch naming",
   "main": "index.js",
   "bin": {