commit-sheriff 1.6.1 → 1.6.2

package/README.md

@@ -310,16 +310,22 @@ It installs whatever it needs automatically (via `npm install --save-dev`, same
 `lint-staged`/`eslint`/`prettier`), skipping anything already present:
 
 ```bash
-npm install --save-dev eslint@^9 typescript @typescript-eslint/parser \
-  @typescript-eslint/eslint-plugin @eslint/js @eslint/eslintrc eslint-plugin-sonarjs \
+npm install --save-dev eslint@^9 typescript@^5 @typescript-eslint/parser \
+  @typescript-eslint/eslint-plugin @eslint/js@^9 @eslint/eslintrc eslint-plugin-sonarjs \
   eslint-plugin-import eslint-plugin-prettier eslint-config-prettier eslint-plugin-react \
   eslint-plugin-react-hooks eslint-plugin-jsx-a11y eslint-plugin-testing-library \
   @vitest/eslint-plugin eslint-plugin-jest prettier
 ```
 
-`eslint` is pinned to `^9` on purpose rather than left to resolve to whatever `latest` is — plugins
-like `eslint-plugin-react` have historically taken a while to support each new ESLint major, so an
-unpinned install can grab a version the rest of the toolchain doesn't work with yet.
+`eslint`, `@eslint/js`, and `typescript` are pinned on purpose rather than left to resolve to
+whatever `latest` is — the plugin ecosystem here regularly lags behind both. Two concrete
+conflicts this has already caused: `@eslint/js`'s own `latest` declares a hard peer on
+`eslint@^10`, so leaving it unpinned next to `eslint@^9` is an instant `ERESOLVE`; and
+`@typescript-eslint/eslint-plugin` currently only supports `typescript` up to `<6.1.0`, so an
+unpinned `typescript` install (which resolves to its own `latest`, e.g. `7.x`) crashes plugin
+loading with "typescript-eslint does not support TS 7.0". Pinning `eslint`/`@eslint/js` together
+to `^9` and `typescript` to `^5` keeps the whole toolchain on versions that are actually
+compatible with each other today.
 
 If the install fails (offline, registry issue, etc.), it prints this exact command so you can run
 it yourself.

package/bin/commit-sheriff.js

@@ -202,11 +202,19 @@ function init() {
 const ESLINT_REACT_DEV_DEPS = [
   // Pinned (not left to resolve to "latest") — see the comment on the eslint@^9 install in
   // mergeConfig() for why: the plugin ecosystem here regularly lags behind ESLint's newest major.
+  // @eslint/js in particular is versioned in lockstep with ESLint core and its `latest` (10.x)
+  // declares a hard peerDependency on eslint@^10 — installing it unpinned alongside eslint@^9
+  // produces an immediate ERESOLVE conflict, which is exactly what this pin prevents.
   "eslint@^9",
-  "typescript",
+  // Same lag problem, different package: @typescript-eslint/eslint-plugin@8.65.0 declares
+  // `typescript: ">=4.8.4 <6.1.0"` as a peer, but unpinned "typescript" resolves to npm's
+  // "latest" (7.x once TypeScript ships a 7.0) — that's outside the supported range and
+  // crashes plugin loading with "typescript-eslint does not support TS 7.0". Pinning to the
+  // latest 5.x line keeps us inside the range the plugin actually supports today.
+  "typescript@^5",
   "@typescript-eslint/parser",
   "@typescript-eslint/eslint-plugin",
-  "@eslint/js",
+  "@eslint/js@^9",
   "@eslint/eslintrc",
   "eslint-plugin-sonarjs",
   "eslint-plugin-import",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commit-sheriff",
-  "version": "1.6.1",
+  "version": "1.6.2",
   "description": "Shared husky commit-msg / pre-commit hooks enforcing ticket-based commit messages and branch naming",
   "main": "index.js",
   "bin": {