Now we're talking. Tested this in a local branch

$ npm run lint

> ssri@10.0.2 lint
> eslint "**/*.js"


/Users/wraithgar/Development/npm/ssri/branches/main/lib/index.js
  3:13  error  'tap' should be listed in the project's dependencies, not devDependencies  import/no-extraneous-dependencies

✖ 1 problem (1 error, 0 warnings)

Gonna give @lukekarrys a few days to weigh in since he's done more work on these rules than I have.

This is great, thank you @tjenkinson!

Need to do some housekeeping on this repo before we can publish.

The irony is we'll have to work around this rule in node-semver since it has an exception to having its code in ./lib.

This was still the right choice because we really want to centrally manage this opinion across our 80+ repos, not just piecemeal it.

The irony is we'll have to work around this rule in node-semver since it has an exception to having its code in ./lib.

Is there a reason it’s an exception? If not wondering if it could be updated to move things into a lib dir, instead of having a custom config?

Ah nevermind I see the readme advertises importing directly from the other dirs

we opted not to change node-semver cause it was deemed a disruptive semver major change.