ITADN

mode: 'patch' is overridden by unexpected 'minor' update for locked packages

#209OpenIridescent-cdu 创建于 2025-09-12
bugpr welcome
I
Iridescent-cducommented
### Clear and concise description of the problem **Context:** In my project, I lock all dependencies to exact versions for maximum stability. I want to use `taze` to periodically check for and apply **only** safe patch updates. **My Configuration (`taze.config.js`):** ```javascript import { defineConfig } from 'taze' export default defineConfig({ mode: 'patch', includeLocked: true, }) ``` **To Reproduce:** 1. In a `package.json`, lock a dependency, e.g., `"some-lib": "1.2.0"`. 2. Ensure that no higher `1.2.x` version of `some-lib` exists, but a `1.3.0` version is available. 3. Use the `taze.config.js` configuration shown above. 4. Run `taze`. **Current Behavior:** `taze` suggests updating `some-lib` from `1.2.0` to `1.3.0`. **Expected Behavior:** I expect `taze` to strictly adhere to the `mode: 'patch'` configuration. In this scenario, since no patch update is available, it should report "no updates found" instead of suggesting a minor update. The user's explicit configuration should take precedence over the built-in fallback logic. **Problem Analysis:** The issue seems to stem from this code in `resolves.ts`. When `mode` is `'patch'` and no patch update is found, it triggers a fallback check that is hardcoded to `'minor'`. ```javascript if (versionLocked && semver.eq(dep.currentVersion, dep.targetVersion)) { // for example: `taze`/`taze -P` is default mode (and it matched from patch to minor) // - but this mode will always ignore the locked pkgs // - so we need to reset the target const { versions, time = {}, tags } = dep.pkgData const targetVersion = getMaxSatisfying(versions, dep.currentVersion, 'minor', tags) if (targetVersion) { dep.targetVersion = targetVersion dep.targetVersionTime = time[dep.gargetVersion] } } ``` ### Suggested solution Add a new configuration option, for example `strictLockedMode: true`, to allow users to strictly enforce the `mode` configuration for locked packages. When this option is `true`, `taze` would strictly respect the `mode` configuration and disable the fallback logic, even if no updates are found. This would provide greater flexibility for users who require stricter version control. ### Alternative _No response_ ### Additional context _No response_ ### Validations - [x] Follow our [Code of Conduct](https://github.com/antfu/.github/blob/main/CODE_OF_CONDUCT.md) - [x] Read the [Contributing Guide](https://github.com/antfu/contribute). - [x] Check that there isn't already an issue that request the same feature to avoid creating a duplicate.
2 条评论