[Espresso] Update truth package to 1.1.3

[reidbaker]

Takeover from dependabot

Pre-launch Checklist

• I read the [Contributor Guide] and followed the process outlined there for submitting PRs.
• I read the [Tree Hygiene] wiki page, which explains my responsibilities.
• I read and followed the [relevant style guides] and ran the auto-formatter. (Unlike the flutter/flutter repo, the flutter/packages repo does use dart format.)
• I signed the [CLA].
• The title of the PR starts with the name of the package surrounded by square brackets, e.g. [shared_preferences]
• I listed at least one issue that this PR fixes in the description above.
• I updated pubspec.yaml with an appropriate new version according to the [pub versioning philosophy], or this PR is [exempt from version changes].
• I updated CHANGELOG.md to add a description of the change, [following repository CHANGELOG style].
• I updated/added relevant documentation (doc comments with ///).
• I added new tests to check the change I am making, or this PR is [test-exempt].
• All existing and new tests are passing.

[flutter-dashboard]

It looks like this pull request may not have tests. Please make sure to add tests before merging. If you need an exemption to this rule, contact Hixie on the #hackers channel in Chat (don't just cc him here, he won't see it! He's on Discord!).

If you are not sure if you need tests, consider this rule of thumb: the purpose of a test is to make sure someone doesn't accidentally revert the fix. Ask yourself, is there anything in your PR that you feel it is important we not accidentally revert back to how it was before your fix?

Reviewers: Read the Tree Hygiene page and make sure this patch meets those guidelines before LGTMing.

[reidbaker]

"No version change found, but the change to this package could not be verified to be exempt from version changes according to repository policy. If this is a false positive, please comment in the PR to explain why the PR is exempt,"

I think the "next" label is the correct update because this change adds limited value to end users and they should not need to pickup a new version until we add some other change.

[gmackall]

LGTM

[stuartmorgan]

because this change adds limited value to end users

The bar we generally use for our continuous release model is not really "value to end users", but "has an effect on end users". In this case since (IIUC) api is a public dependency, this would not be exempt by policy, because package clients would be potentially impacted.

But it's a general policy, not a commandment; it's fine to use discretion. The CI check isn't to make it rigid, but to make sure people are making a deliberate decision (rather than just forgetting, which definitely happened more than you might think).

(One thing to keep in mind though is that part of the reason we moved to continuous release was that we had things happen like: someone made a change for compatibility with master for a change that wouldn't arrive on stable for several months, and didn't bump the version because there was no rush and it could wait until the next change... and then nobody changed the package for several months, and suddenly everyone was broken on stable just because we never published a fix. For a package like espresso, "later" can be a very long time; almost every change to espresso in the last year or more is either a change like this, or some mass change like an SDK update.)

[reidbaker]

because this change adds limited value to end users

The bar we generally use for our continuous release model is not really "value to end users", but "has an effect on end users". In this case since (IIUC) api is a public dependency, this would not be exempt by policy, because package clients would be potentially impacted.

But it's a general policy, not a commandment; it's fine to use discretion. The CI check isn't to make it rigid, but to make sure people are making a deliberate decision (rather than just forgetting, which definitely happened more than you might think).

(One thing to keep in mind though is that part of the reason we moved to continuous release was that we had things happen like: someone made a change for compatibility with master for a change that wouldn't arrive on stable for several months, and didn't bump the version because there was no rush and it could wait until the next change... and then nobody changed the package for several months, and suddenly everyone was broken on stable just because we never published a fix. For a package like espresso, "later" can be a very long time; almost every change to espresso in the last year or more is either a change like this, or some mass change like an SDK update.)

Thank you for that clarification. Version number updated. This is a case where I don't actually have an opinion I just want to follow the existing rules.