taze

Taze

(/ta:zei/, fresh in Persian)

A modern cli tool that keeps your deps fresh

npx taze

or recursively for monorepos

npx taze -r

or for agents to consume

npx taze -r --json

## Features - Built-in support for monorepos - No installation required — `npx taze` - Safe by default — updates in the version range you are allowed - Interactive mode to select which packages to update - Respects `package.json`'s `engines` field and your package manager's config - Updates GitHub Actions in your workflows, with optional SHA pinning - Updates the Node.js version pinned in `.node-version` and `.nvmrc` - Agents compatible JSON output ## Usage By default, `taze` will only bump versions in the ranges you specified in `package.json` *(which is safe and the default behavior of `npm install`)*

To ignore the ranges, explicitly set the maximum allowed version change. For example `taze major` will check all changes and bump to the latest stable changes including majors (breaking changes), or `taze minor` that bump to latest minor changes within the same major version.

Check for major updates

Check up to minor updates

Check up to patch updates

### Monorepo `taze` has the built-in first-class monorepo support. Simply adding `-r` will scan the subdirectories that contain `package.json` and update them together. It will handle local private packages automatically.

## Configuration See `taze --help` for more details ### Filters You can filter out packages you want to check for upgrades by `--include` or `--exclude`; they accept string and regex, separated by commas (,). ```bash taze --include lodash,webpack taze --include /react/ --exclude react-dom # regex is also supported ``` `--exclude` (and `--include`) also accepts a `name@range` selector to exclude only a specific version range of a package, instead of the whole package. This is useful to block a specific major version while still allowing other updates (including in interactive mode): ```bash # skip typescript's major v7 (and later), but still offer v6 minor/patch updates taze --exclude typescript@7 taze --exclude "typescript@^7||^8" # multiple ranges can be combined with || ``` Dependencies listed in pnpm's `update.ignoreDeps` in `pnpm-workspace.yaml` are automatically excluded, so packages you tell pnpm never to update are also skipped by taze. ### Locked Versions Locked (fixed version without `^` or `~`) packages are skipped by default, use `taze --include-locked` or `taze -l` to show them. ### Peer Dependencies Bumping version in `peerDependencies` is not enabled by default. Pass `--peer` option to include them in the update process. ```bash taze --peer ``` ### Maturity Period By default the most recent version of a dependency is used. You may choose to filter to versions that have been out longer by passing `--maturity-period`. ```bash taze --maturity-period ``` The filter when using the maturity-period flag is 7 days. You may also want to pass a day value to have a longer or shorter number of days. ```bash taze --maturity-period 14 ``` You can exclude packages from the maturity filter. This is also inferred from package manager config when available, such as `minimumReleaseAgeExclude` in `pnpm-workspace.yaml` and `npmPreapprovedPackages` in `.yarnrc.yml`. ```bash taze --maturity-period-exclude react,webpack ``` If you want stable releases only while still honoring the maturity period, use `stable` mode. ```bash taze stable --maturity-period 14 ``` > [!NOTE] > This kind of filtering is sometimes called `cooldown` or `minimumReleaseAge` by other tools. ### JSON Output Pass `--json` to output the resolved update info as JSON to stdout instead of the rendered table. This is handy for scripting and CI. ```bash taze --json ``` When `--json` is used, `--interactive` is ignored and no progress bars, tables, or tips are printed. By default only dependencies with an available update are included; combine it with `--all` to include up-to-date dependencies too. It can still be combined with `-w` to write the changes back to `package.json`. ### GitHub Actions `taze` also checks the GitHub Actions used in your workflows. When a `.github/workflows` directory exists, it scans `.github/workflows/*.{yml,yaml}`, composite actions (`.github/actions/**/action.{yml,yaml}` and a repo-root `action.{yml,yaml}`), and reusable workflow calls, then reports newer versions alongside your npm dependencies. It works with every mode (`major`, `minor`, ...), `--interactive`, `--json`, and `-w`. ```bash taze major -w # also updates outdated actions, e.g. actions/checkout@v3 -> @v4 taze --no-github-actions # opt out ``` References are updated in place while preserving the granularity you wrote (`@v4` → `@v5`, `@v4.1.1` → `@v4.2.0`). By default the existing style of each action is kept: tag references stay tags, while SHA-pinned references stay pinned (with a refreshed `# vX.Y.Z` comment). Choose a style explicitly with `--github-actions-style `: ```yaml # style: sha — pin to an immutable commit for supply-chain safety - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 # style: tag - uses: actions/checkout@v5 ``` Only `v`-prefixed version tags are considered; branch refs (`@main`), non-`v` tags, `docker://` and local (`./`) actions are left untouched. Filtering (`--include`/`--exclude`/`packageMode`), the maturity-period cool-down, and mode all apply, matched by the action's `owner/repo` name. Versions are fetched from the GitHub REST API. Set a `GITHUB_TOKEN` (or `GH_TOKEN`) to raise the rate limit from 60 to 5000 requests/hour: ```bash GITHUB_TOKEN=xxxx taze major ``` If neither is set, taze falls back to a token from the [GitHub CLI](https://cli.github.com) (`gh auth token`) when you're logged in, so an authenticated `gh` needs no extra configuration. ### JSR `taze` checks [JSR](https://jsr.io) dependencies alongside your npm ones. Both ways of declaring a JSR package are supported: ```jsonc { "dependencies": { // native jsr: protocol (pnpm / deno) — versions come from jsr.io "@std/cli": "jsr:^1.0.0", // npm-compat form written by `npx/bunx jsr add` — needs `@jsr:registry=https://npm.jsr.io` in .npmrc "@std/encoding": "npm:@jsr/std__encoding@^1.0.0" } } ``` `jsr:` specifiers are resolved against the JSR registry (yanked versions are skipped) and written back in place preserving the `jsr:` prefix. All modes, filtering, and `-w` apply as usual. ### Node.js version `taze` also keeps the Node.js version pinned in `.node-version`, `.nvmrc`, and a `package.json` [`devEngines.runtime`](https://github.com/nodejs/node/blob/main/doc/api/packages.md#devengines) entry fresh. It checks these files in the current directory, and with `-r` it discovers nested ones too (honoring `ignorePaths`); a neighboring `package.json` is not required for the `.node-version` / `.nvmrc` files. ```bash taze # stay on the current Node.js major taze patch # stay on the current major and minor taze major -w # allow a newer major and write the file taze --no-node-version # opt out ``` In `.node-version` / `.nvmrc` only stable numeric references with an optional `v` prefix are recognized (`22`, `22.14`, `v22.14.0`); aliases (`lts/*`, `node`), ranges, and prereleases are left untouched. The written reference keeps the shape you had — a major-only `22` stays major-only, and the `v` prefix, surrounding whitespace, and any comments/blank lines are preserved. A `devEngines.runtime` pin whose `name` is `node` is instead treated as a semver range and rewritten in place, preserving the range operator (`>=20` → `>=26.7.0`, `^20.0.0` → `^20.20.2`); `runtime` may be a single object or an array (only the `node` entry is touched). Releases and their dates come from the official [Node.js distribution index](https://nodejs.org/dist/index.json), so `maturityPeriod` and version-specific exclusions apply here too. Filtering uses the dependency name `node` (`--include node`, `--exclude node`, `packageMode.node`), and `--no-node-version` / `nodeVersion: false` opts out of all of the above. Writing the files does not install or switch the active Node.js runtime. ### Config file With `taze.config.js` file, you can configure the same options the command has. ``` … ``` ### Custom Manifests taze discovers, reads and writes each kind of dependency file through a `Manifest` (package.json, package.yaml, pnpm/bun/yarn catalogs, GitHub workflows). You can register your own to support extra file types, via the `manifests` option in your config or programmatically. Custom manifests are merged ahead of the built-ins, so they can also override how an existing file type is handled. ``` … ``` > Only available from a JS/TS config file or programmatically, not from `.tazerc.json`. ## Alternatives `taze` is inspired by the following tools. - [npm-check-updates](https://github.com/raineorshine/npm-check-updates) - [npm-check](https://github.com/dylang/npm-check) They work well but have different focuses and feature sets, try them out as well :) ## Thanks Great thanks to [@sinoon](https://github.com/sinoon) who helped a lot with idea brainstorming and feedback discussion. The GitHub Actions updating feature is inspired by and credits [actions-up](https://github.com/azat-io/actions-up) by [Azat S.](https://azat.io), which pioneered the interactive SHA-pinning workflow this builds upon. ## License MIT License © 2020 [Anthony Fu](https://github.com/antfu)