mode: 'patch' is overridden by unexpected 'minor' update for locked packages
bugpr welcome
### Clear and concise description of the problem
**Context:**
In my project, I lock all dependencies to exact versions for maximum stability. I want to use `taze` to periodically check for and apply **only** safe patch updates.
**My Configuration (`taze.config.js`):**
```javascript
import { defineConfig } from 'taze'
export default defineConfig({
mode: 'patch',
includeLocked: true,
})
```
**To Reproduce:**
1. In a `package.json`, lock a dependency, e.g., `"some-lib": "1.2.0"`.
2. Ensure that no higher `1.2.x` version of `some-lib` exists, but a `1.3.0` version is available.
3. Use the `taze.config.js` configuration shown above.
4. Run `taze`.
**Current Behavior:**
`taze` suggests updating `some-lib` from `1.2.0` to `1.3.0`.
**Expected Behavior:**
I expect `taze` to strictly adhere to the `mode: 'patch'` configuration. In this scenario, since no patch update is available, it should report "no updates found" instead of suggesting a minor update. The user's explicit configuration should take precedence over the built-in fallback logic.
**Problem Analysis:**
The issue seems to stem from this code in `resolves.ts`. When `mode` is `'patch'` and no patch update is found, it triggers a fallback check that is hardcoded to `'minor'`.
```javascript
if (versionLocked && semver.eq(dep.currentVersion, dep.targetVersion)) {
// for example: `taze`/`taze -P` is default mode (and it matched from patch to minor)
// - but this mode will always ignore the locked pkgs
// - so we need to reset the target
const { versions, time = {}, tags } = dep.pkgData
const targetVersion = getMaxSatisfying(versions, dep.currentVersion, 'minor', tags)
if (targetVersion) {
dep.targetVersion = targetVersion
dep.targetVersionTime = time[dep.gargetVersion]
}
}
```
### Suggested solution
Add a new configuration option, for example `strictLockedMode: true`, to allow users to strictly enforce the `mode` configuration for locked packages. When this option is `true`, `taze` would strictly respect the `mode` configuration and disable the fallback logic, even if no updates are found. This would provide greater flexibility for users who require stricter version control.
### Alternative
_No response_
### Additional context
_No response_
### Validations
- [x] Follow our [Code of Conduct](https://github.com/antfu/.github/blob/main/CODE_OF_CONDUCT.md)
- [x] Read the [Contributing Guide](https://github.com/antfu/contribute).
- [x] Check that there isn't already an issue that request the same feature to avoid creating a duplicate.
2 条评论