feat(cooldown): add cooldown feature
#1547
Conversation
…e clarity in documentation
…ify purpose and usage
| @@ -909,6 +931,16 @@ const cliOptions: CLIOption[] = [ | |||
| description: 'Run on all workspaces. Add `--root` to also upgrade the root project.', | |||
| type: 'boolean', | |||
| }, | |||
| { | |||
| long: 'cooldown', | |||
There was a problem hiding this comment.
question: (to foster discussion) Is cooldown the best name for this feature?
| arg: 'n', | ||
| description: | ||
| 'Delay updates to newly published versions to reduce risk. Sets a minimum number of days after publication before a version is considered for upgrade.', | ||
| type: 'number', |
There was a problem hiding this comment.
question: (to foster discussion) Is days a right unit for this feature? Maybe hours will be more flexible
There was a problem hiding this comment.
clarification: this file is used later by unit tests related to the cooldown feature.
|
Thank you! I have one initial comment about the expected behavior. The default target for npm-check-updates is whatever version is published to the In theory you could make some assumptions and use a heuristic, but the design philosophy of npm-check-updates is to strictly follow semver and choose the conservative approach when faced with ambiguity. There are packages that publish build numbers to If |
Description
This PR introduces a new
--cooldownoption to ncu, inspired by Dependabot’s cooldown and pnpm’s minimumReleaseAge.The cooldown feature reduces the risk of installing compromised packages by delaying updates to versions that were published too recently. It enforces a minimum number of days that must pass after a version’s release before it can be considered for upgrade.
Usage
ncu --cooldown [days]ncu -c [days]Example
Suppose your project uses version
1.0.0of a package, and these versions are available:1.0.0– released 60 days ago1.1.0– released 45 days ago1.2.0– released 20 days ago1.3.0– released 10 days agoRunning:
ncu --cooldown 30will upgrade to1.1.0, since it was released 45 days ago and is the latest version outside the 30-day cooldown period. Versions1.2.0and1.3.0are skipped because they fall within the cooldown window.Resolves: #1532