Eslint-plugin-sonarjs: Use ranges, don't pin dependency versions in package.json

SonarQube for IDE
1

eslint-plugin-sonarjs v3.0.1 uses pinned versions for most its of dependencies in its package.json (Same problem in older plugin versions):

(Source: SonarJS/generate-eslint-package-json.mjs at 35bbdbc4085212daa906481f4f405fe5cc3e06c5 · SonarSource/SonarJS · GitHub)

It’s kind of odd that the plugin uses range in "typescript": "^5", but everything else is pinned, like "@babel/core": "7.26.0".

Version pinning can be understantable for apps, but not really for libraries (or in this case, plugin). If everybody would do that, node_modules would explode in size.

https://www.reddit.com/r/node/comments/higlf0/heaviest_objects_in_the_universe/

4

Hello @attekemppila,

thanks for reporting this. You can indeed right that we should not be pinned to fixed versions of those dependencies. I created a ticket to have this done for the next release.

Cheers,
Victor