Merge pull request microsoft#1046 from saschanaz/microsoft-merge

Update package-lock.json only

.github/dependabot.yml

@@ -10,7 +10,5 @@ updates:
  # Check the npm registry for updates every month
  schedule:
  interval: "monthly"
- # Bump versions in package.json
- # https://github.com/dependabot/dependabot-core/issues/3103
- # https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#versioning-strategy
- versioning-strategy: "increase"
+ # Bump versions only in package-lock.json
+ versioning-strategy: "lockfile-only"

.github/workflows/update-core-deps.yml

@@ -16,9 +16,11 @@ jobs:
  with:
  node-version: '15'
 
+ # Use ncu to detect major version changes
  - run: npm i -g npm-check-updates
  - run: ncu -u
  - run: npm i
+ - run: git restore package.json
  - run: npm run build && npm run baseline-accept
  - id: git-diff
  run: git diff --quiet HEAD baselines

package.json

@@ -38,16 +38,16 @@
  "license": "Apache-2.0",
  "type": "module",
  "devDependencies": {
- "@mdn/browser-compat-data": "3.3.9",
+ "@mdn/browser-compat-data": "^3.3.9",
  "@types/jsdom": "^16.2.12",
  "@types/node": "^15.12.5",
  "@types/node-fetch": "^2.5.10",
  "@types/webidl2": "^23.13.5",
  "@typescript-eslint/eslint-plugin": "^4.28.1",
  "@typescript-eslint/parser": "^4.28.1",
- "@webref/css": "2.0.2",
- "@webref/elements": "1.0.1",
- "@webref/idl": "2.2.6",
+ "@webref/css": "^2.0.2",
+ "@webref/elements": "^1.0.1",
+ "@webref/idl": "^2.2.6",
  "cpx2": "^3.0.0",
  "danger": "^10.6.6",
  "eslint": "^7.29.0",