chore(deps): pin dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
chai (source)	devDependencies	pin	^4.1.2 -> 4.1.2
ghooks	devDependencies	pin	^2.0.4 -> 2.0.4
in-publish	devDependencies	pin	^2.0.0 -> 2.0.0
mocha-junit-reporter	devDependencies	pin	^1.18.0 -> 1.18.0
mocha-multi-reporters	devDependencies	pin	^1.1.7 -> 1.1.7
proxyquire	devDependencies	pin	^2.1.0 -> 2.1.0
sinon (source)	devDependencies	pin	^6.3.4 -> 6.3.4

📌 Important: Renovate will wait until you have merged this Pin PR before creating any upgrade PRs for the affected packages. Add the preset :preserveSemverRanges to your config if you instead don't wish to pin dependencies.

---

Renovate configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by WhiteSource Renovate. View repository job log here.

[LinusU]

Why do we want this? 🤔

Isn't the package-lock.json file better suited for this?

[codecov-commenter]

Codecov Report

❗ No coverage uploaded for pull request base (master@e22dd6c). Click here to learn what that means.
The diff coverage is n/a.

[dmwelch]

@LinusU I think this just enforces pinned dependency versions...

This would prevent security breach issues like the one that happened a couple years back with event-stream by preventing users from upgrading a dependency to a newer (and possibly malicious) version. The package-lock.json file only applies when you run npm ci, so a relative version in the package.json would pull the latest version regardless of the contents of the lock file, as I understand it.

[commitizen-bot]

🎉 This PR is included in version 4.2.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀