Pin @angular-eslint/eslint-plugin instead of using "latest"

haydenbleasel · haydenbleasel · commit 9a2b548ae20e · 2026-05-10T14:49:55.000-07:00
diff --git a/.changeset/eslint-angular-pin.md b/.changeset/eslint-angular-pin.md
@@ -0,0 +1,5 @@
+---
+"ultracite": patch
+---
+
+Pin `@angular-eslint/eslint-plugin` to `^21.3.1` in `packages/cli/package.json`. Previously declared as `"latest"`, which defeats lockfile reproducibility and means each `bun install` could pull a newer version than what was tested at publish time. The current resolved version (21.3.1) is unchanged.
diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -66,7 +66,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@angular-eslint/eslint-plugin": "latest",
+    "@angular-eslint/eslint-plugin": "^21.3.1",
     "@biomejs/biome": "2.4.15",
     "@eslint/js": "^10.0.1",
     "@next/eslint-plugin-next": "^16.2.6",

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"ultracite": patch
 +---
++
 +Pin `@angular-eslint/eslint-plugin` to `^21.3.1` in `packages/cli/package.json`. Previously declared as `"latest"`, which defeats lockfile reproducibility and means each `bun install` could pull a newer version than what was tested at publish time. The current resolved version (21.3.1) is unchanged.