Feature Request: Cooldown Parameter(s)

[stdavis]

Thanks for the awesome project! We use it regularly to help keep our projects up-to-date in conjunction with GitHub's Dependabot.

It would be cool (pun intended) to add functionality similar to the cooldown option for Dependabot to this project. We recently implemented this setting in a bunch of our projects. It would be nice if we could configure ncu to behave in a similar way.

I'd be interested in helping to implement this with some direction from the maintainers so that I don't go down the wrong road.

[raineorshine]

Hi, thanks for your interest.

This has some overlap with #833.

It looks like Dependabot's cooldown is highly configurable. Do you have any idea of which subset of cooldown functionality you would like to add to npm-check-updates? Less configuration/fewer options would be preferable from a design standpoint, and would give us room to grow in the future.

I have limited time these days, but I can point you in the right direction. Briefly, options are defined in cli-options.ts. A reasonable place to put the predicate might be filters.ts. time would need to be added to the packument fields (as done here) when the age/cooldown option is enabled. Happy to answer more questions.

[stdavis]

What about a cooldown parameter that could take a single number or a list of three numbers. The single number would represent the number of days to wait on any type of version bump. Three numbers would represent the numbers of days to wait on major, minor, and patch releases in that order.

# wait ten days on any version bump
ncu --cooldown 10

# wait 60 days on major, 30 days on minor, and 15 days on patch
ncu --cooldown 60,30,15

What do you think, @raineorshine?

[raineorshine]

I like the simplicity of ncu --cooldown 10.

Let's consider major,minor,patch syntax in a separate PR since it's backwards compatible.

[SebastianSedzik]

@raineorshine Considering the recent NPM supply chain attacks, the cooldown functionality seems quite valuable. @stdavis Do you plan to implement this in the near term? Do you need any support in moving this forward?

[stdavis]

@SebastianSedzik I agree with your assessment given recent events. However, I have not been able to prioritize this yet. If anyone else wants to take a stab at it, feel free. I do hope to be able to get to it at some point.

[SebastianSedzik]

@stdavis Sure, I can take care of this 👍🏻

[jdalton]

Related: On naming taze calls a similar feature --maturity-period and pnpm calls it minimumReleaseAge.

Update: Oh 🤦, dependabot calls this cooldown (as referenced above). I like that name a lot 👍