Release a v1.0.0

[wrumsby]

Is your feature request related to a problem? Please describe.

This packaged was released several years ago with a statement that suggested a 1.0 release would be available "soon" (#465).

By convention npm packages generally follow semantic versioning and tooling exists to support this. Adopting semantic versioning and publishing a v1.0.0 conveys a commitment for non-breaking changes when providing minor or patch releases.

I'd love to be able to have Dependabot and other tools suggest updates for this package that I could feel confident in so that my projects are using the latest version of this package that they can without having to dig through the release notes of multiple updates to the v0.x.

It seems like there have been 2-3 breaking changes per year since #465 was merged, but no breaking changes for over a year. Realistically the minor version suggests we'd be on v12.x if following semantic-release and that's not the end of the world.

Describe the solution you'd like

It's been 5 years, let's release a v1.0.0 and commit to following semantic release so that the people who are using this package can make some reasonable assumptions about backwards compatibility and use tooling that assumes semantic versioning.

Describe alternatives you've considered

N/A

Additional context

N/A

[ricellis]

a statement that suggested a 1.0 release would be available "soon"

Well it doesn't actually say anything about soon 😄

I'd love to be able to have Dependabot and other tools suggest updates for this package that I could feel confident in so that my projects are using the latest version of this package that they can without having to dig through the release notes of multiple updates to the v0.x.

Since 0.2.0 we have never made a breaking change under a patch bump.
0.6.0 was the only minor release that introduced new APIs and had no breaking changes.

I hope that provides sufficient confidence that you can safely accept patch versions. An exception to be aware of, as outlined in the README, is supported Node.js versions. Not a problem if you deploy on LTS releases though.

As per #1376 (comment) it is possible to take only the patch updates with a ^ range. If you have a pinned version then the equivalent @dependabot ignore minor should provide only the patch update PRs that are expected to be non-breaking.

I hope that helps in the meantime. We hear you and appreciate your feedback on this - it's definitely on our radar. While internal priorities have shifted our timelines we've been investing our efforts ensuring the library stays up-to-date and as secure as possible. I expect to be able to provide more updates on a v1 later in the year.