🥦 Taze

^{(/ta:zei/, fresh in Persian)}

A modern cli tool that keeps your deps fresh

npx taze

or recursively for monorepos

npx taze -r

Features

• Built-in support for monorepos
• No installation required — npx taze
• Safe by default — updates in the version range you are allowed

Usage

By default, taze will only bump versions in the ranges you specified in package.json (which is safe and the default behavior of npm install)

To ignore the ranges, explicitly set the maximum allowed version change.

For example taze major will check all changes and bump to the latest stable changes including majors (breaking changes), or taze minor that bump to latest minor changes within the same major version.

Check for major updates

Check up to minor updates

Check up to patch updates

Monorepo

taze has the built-in first-class monorepo support. Simply adding -r will scan the subdirectories that contain package.json and update them together. It will handle local private packages automatically.

Configuration

See taze --help for more details

Filters

You can filter out packages you want to check for upgrades by --include or --exclude; they accept string and regex, separated by commas (,).

taze --include lodash,webpack
taze --include /react/ --exclude react-dom # regex is also supported

Locked Versions

Locked (fixed version without ^ or ~) packages are skipped by default, use taze --include-locked or taze -l to show them.

Peer Dependencies

Bumping version in peerDependencies is not enabled by default. Pass --peer option to include them in the update process.

taze --peer

Maturity Period

By default the most recent version of a dependency is used. You may choose to filter to versions that have been out longer by passing --maturity-period.

taze --maturity-period

The filter when using the maturity-period flag is 7 days. You may also want to pass a day value to have a longer or shorter number of days.

taze --maturity-period 14

You can exclude packages from the maturity filter. This is also inferred from package manager config when available, such as minimumReleaseAgeExclude in pnpm-workspace.yaml and npmPreapprovedPackages in .yarnrc.yml.

taze --maturity-period-exclude react,webpack

If you want stable releases only while still honoring the maturity period, use stable mode.

taze stable --maturity-period 14

[!NOTE] This kind of filtering is sometimes called cooldown or minimumReleaseAge by other tools.

JSON Output

Pass --json to output the resolved update info as JSON to stdout instead of the rendered table. This is handy for scripting and CI.

taze --json

When --json is used, --interactive is ignored and no progress bars, tables, or tips are printed. By default only dependencies with an available update are included; combine it with --all to include up-to-date dependencies too. It can still be combined with -w to write the changes back to package.json.

Config file

With taze.config.js file, you can configure the same options the command has.

import { defineConfig } from 'taze'

export default defineConfig({
  // ignore packages from bumping
  exclude: [
    'webpack'
  ],
  // fetch latest package info from registry without cache
  force: true,
  // retry behavior when fetching package metadata fails:
  // a number for retry count, `false` to disable, or an object for fine-grained
  // control, e.g. { retries: 4, factor: 2, minTimeout: 1000, maxTimeout: 30_000, randomize: false }
  retry: 4,
  // write to package.json
  write: true,
  // run `npm install` or `yarn install` right after bumping
  install: true,
  // ignore paths for looking for package.json in monorepo
  ignorePaths: [
    '**/node_modules/**',
    '**/test/**',
  ],
  // ignore package.json that in other workspaces (with their own .git,pnpm-workspace.yaml,etc.)
  ignoreOtherWorkspaces: true,
  // override with different bumping mode for each package
  packageMode: {
    'typescript': 'major',
    'unocss': 'ignore',
    // regex starts and ends with '/'
    '/vue/': 'latest'
  },
  // exclude packages from the maturity period filter
  maturityPeriodExclude: [
    'react',
    '@myorg/*',
  ],
  // disable checking for "overrides" package.json field
  depFields: {
    overrides: false
  }
})

Alternatives

taze is inspired by the following tools.

• npm-check-updates
• npm-check

They work well but have different focuses and feature sets, try them out as well :)

Thanks

Great thanks to @sinoon who helped a lot with idea brainstorming and feedback discussion.

License

MIT License © 2020 Anthony Fu