Merge pull request #1046 from saschanaz/microsoft-merge

Update package-lock.json only

Author: Orta Therox

.github/dependabot.yml

@@ -10,7 +10,5 @@ updates:
     # Check the npm registry for updates every month
     schedule:
       interval: "monthly"
-    # Bump versions in package.json
-    # https://github.com/dependabot/dependabot-core/issues/3103
-    # https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#versioning-strategy
-    versioning-strategy: "increase"
+    # Bump versions only in package-lock.json
+    versioning-strategy: "lockfile-only"

.github/workflows/update-core-deps.yml

@@ -16,9 +16,11 @@ jobs:
         with:
           node-version: '15'
 
+      # Use ncu to detect major version changes
       - run: npm i -g npm-check-updates
       - run: ncu -u
       - run: npm i
+      - run: git restore package.json
       - run: npm run build && npm run baseline-accept
       - id: git-diff
         run: git diff --quiet HEAD baselines

package-lock.json

@@ -38,16 +38,16 @@
   "license": "Apache-2.0",
   "type": "module",
   "devDependencies": {
-    "@mdn/browser-compat-data": "3.3.9",
+    "@mdn/browser-compat-data": "^3.3.9",
     "@types/jsdom": "^16.2.12",
     "@types/node": "^15.12.5",
     "@types/node-fetch": "^2.5.10",
     "@types/webidl2": "^23.13.5",
     "@typescript-eslint/eslint-plugin": "^4.28.1",
     "@typescript-eslint/parser": "^4.28.1",
-    "@webref/css": "2.0.2",
-    "@webref/elements": "1.0.1",
-    "@webref/idl": "2.2.6",
+    "@webref/css": "^2.0.2",
+    "@webref/elements": "^1.0.1",
+    "@webref/idl": "^2.2.6",
     "cpx2": "^3.0.0",
     "danger": "^10.6.6",
     "eslint": "^7.29.0",