[opensourcedex]

taze is a free, open source frameworks & platforms project written in TypeScript and released under MIT. It has 4,283 GitHub stars, 150 forks and 33 open issues, and was last pushed 1 months ago. On this registry it ranks #36 of 49 tracked projects in Frameworks & Platforms, with 5 head-to-head comparisons available.

What is taze?

taze is a modern CLI tool, written in TypeScript and released under the MIT licence, that keeps JavaScript and TypeScript project dependencies fresh by checking for newer versions, resolving what is safe to bump inside the ranges already declared in package.json, and optionally writing those changes back.

What it is

taze lives in the JavaScript and TypeScript ecosystem, where dependency versions are declared in package.json and resolved by package managers such as npm, pnpm, and Yarn. It is a command-line utility that scans a project for declared dependencies, queries the registry for available versions, and reports which of them have moved. Its default behaviour deliberately mirrors the safety of npm install: versions are only bumped inside the ranges the project has already specified, so a routine check does not silently pull in breaking changes. Going wider is an explicit decision, expressed as taze major, taze minor, or taze patch.

The concrete problem it solves is the tedium and risk of tracking dependency drift by hand. Rather than reading release notes, editing version strings package by package, and hoping no range was widened by accident, a developer runs one command and gets a single report of what is stale. It replaces the manual, per-package cycle of checking and editing manifests, and it extends the same treatment beyond package.json: it also inspects the GitHub Actions referenced in workflows and the Node.js version pinned in .node-version and .nvmrc. Monorepos are supported as a first-class case rather than as an afterthought, and local private packages inside the workspace are handled automatically.

Key capabilities

  • Runs without installation as npx taze, and scans monorepo subdirectories containing package.json with npx taze -r, updating them together.
  • Updates GitHub Actions used in .github/workflows when that directory exists, with optional SHA pinning of action references.
  • Updates the Node.js version pinned in .node-version and .nvmrc.
  • Provides an interactive mode for selecting which packages to update, and respects the engines field in package.json along with package manager configuration.
  • Filters packages with --include and --exclude, which accept comma-separated strings and regexes, plus name@range selectors such as taze --exclude typescript@7 or taze --exclude "typescript@^7||^8" to block one major while allowing others.
  • Supports --maturity-period, which defaults to a 7-day cooldown and accepts a day count such as --maturity-period 14, with exclusions through --maturity-period-exclude or via minimumReleaseAgeExclude in pnpm-workspace.yaml and npmPreapprovedPackages in .yarnrc.yml.
  • Emits machine-readable results with --json, ignoring --interactive and suppressing progress bars, tables, and tips, and can combine with -w to write changes back, or with --all to include up-to-date dependencies.
  • Handles locked versions (no ^ or ~) only when --include-locked or -l is passed, and includes peerDependencies only under --peer.

Who uses it and how

  • Monorepo maintainers run npx taze -r to sweep every workspace package in one pass, letting local private packages and their internal references stay consistent.
  • CI pipelines and scripting workflows consume npx taze --json to get structured update data on stdout, and may add -w to persist resolved changes without any interactive prompt.
  • Agent-driven tooling uses the same --json output, since the format is explicitly aimed at programmatic consumption.
  • Teams on pnpm get alignment for free: dependencies listed under update.ignoreDeps in pnpm-workspace.yaml are excluded automatically, so the packages pnpm is told never to update are also skipped here.
  • Risk-averse teams enable --maturity-period (or stable --maturity-period 14) so only releases that have been published long enough are eligible, filtering out versions that are still settling.

Getting started

No installation is required: run npx taze in a project, or npx taze -r for monorepos, and add --json when the output feeds an agent or a script. Configuration options are listed in taze --help.

How it compares

No list of paid products this project replaces was provided, and the facts name no comparable tools, so taze stands alone in this registry.

When to use it — and when not to

It is a self-contained CLI, so there is no database, object storage, or SMTP service to operate, and the cost of adoption is essentially one npx invocation. The limits follow its scope: it covers JavaScript and TypeScript dependency manifests, GitHub Actions workflows, and the .node-version and .nvmrc files, so projects in other language ecosystems get nothing from it, and peerDependencies are excluded unless --peer is passed. Anyone who needs an audited, policy-driven upgrade pipeline with per-package approval records will find a single-command checker too thin, and the excerpted README is sparse enough that the workflow-file scanning details should be verified against the full documentation before relying on them in automation.

project readme (upstream, from github) — read inline

🥦 Taze

(/ta:zei/, fresh in Persian)

A modern cli tool that keeps your deps fresh

npx taze

or recursively for monorepos

npx taze -r

or for agents to consume

npx taze -r --json

Recursive mode

Features

  • Built-in support for monorepos
  • No installation required — npx taze
  • Safe by default — updates in the version range you are allowed
  • Interactive mode to select which packages to update
  • Respects package.json's engines field and your package manager's config
  • Updates GitHub Actions in your workflows, with optional SHA pinning
  • Updates the Node.js version pinned in .node-version and .nvmrc
  • Agents compatible JSON output

Usage

By default, taze will only bump versions in the ranges you specified in package.json (which is safe and the default behavior of npm install)

Default mode

To ignore the ranges, explicitly set the maximum allowed version change.

For example taze major will check all changes and bump to the latest stable changes including majors (breaking changes), or taze minor that bump to latest minor changes within the same major version.


Check for major updates
Major mode

Check up to minor updates
Minor mode

Check up to patch updates
Patch mode

Monorepo

taze has the built-in first-class monorepo support. Simply adding -r will scan the subdirectories that contain package.json and update them together. It will handle local private packages automatically.

Recursive mode default

Configuration

See taze --help for more details

Filters

You can filter out packages you want to check for upgrades by --include or --exclude; they accept string and regex, separated by commas (,).

taze --include lodash,webpack
taze --include /react/ --exclude react-dom # regex is also supported

--exclude (and --include) also accepts a name@range selector to exclude only a specific version range of a package, instead of the whole package. This is useful to block a specific major version while still allowing other updates (including in interactive mode):

# skip typescript's major v7 (and later), but still offer v6 minor/patch updates
taze --exclude typescript@7
taze --exclude "typescript@^7||^8" # multiple ranges can be combined with ||

Dependencies listed in pnpm's update.ignoreDeps in pnpm-workspace.yaml are automatically excluded, so packages you tell pnpm never to update are also skipped by taze.

Locked Versions

Locked (fixed version without ^ or ~) packages are skipped by default, use taze --include-locked or taze -l to show them.

Peer Dependencies

Bumping version in peerDependencies is not enabled by default. Pass --peer option to include them in the update process.

taze --peer

Maturity Period

By default the most recent version of a dependency is used. You may choose to filter to versions that have been out longer by passing --maturity-period.

taze --maturity-period

The filter when using the maturity-period flag is 7 days. You may also want to pass a day value to have a longer or shorter number of days.

taze --maturity-period 14

You can exclude packages from the maturity filter. This is also inferred from package manager config when available, such as minimumReleaseAgeExclude in pnpm-workspace.yaml and npmPreapprovedPackages in .yarnrc.yml.

taze --maturity-period-exclude react,webpack

If you want stable releases only while still honoring the maturity period, use stable mode.

taze stable --maturity-period 14

[!NOTE] This kind of filtering is sometimes called cooldown or minimumReleaseAge by other tools.

JSON Output

Pass --json to output the resolved update info as JSON to stdout instead of the rendered table. This is handy for scripting and CI.

taze --json

When --json is used, --interactive is ignored and no progress bars, tables, or tips are printed. By default only dependencies with an available update are included; combine it with --all to include up-to-date dependencies too. It can still be combined with -w to write the changes back to package.json.

GitHub Actions

taze also checks the GitHub Actions used in your workflows. When a .github/workflows directory exists, it scans .github/workflows/*.{yml,yaml}, composite actions (.github/actions/**/action.{yml,yaml} and a repo-root action.{yml,yaml}), and reusable workflow calls, then reports newer versions alongside your npm dependencies. It works with every mode (major, minor, ...), --interactive, --json, and -w.

taze major -w      # also updates outdated actions, e.g. actions/checkout@v3 -> @v4
taze --no-github-actions   # opt out

References are updated in place while preserving the granularity you wrote (@v4 → @v5, @v4.1.1 → @v4.2.0). By default the existing style of each action is kept: tag references stay tags, while SHA-pinned references stay pinned (with a refreshed # vX.Y.Z comment). Choose a style explicitly with --github-actions-style :

# style: sha — pin to an immutable commit for supply-chain safety
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
# style: tag
- uses: actions/checkout@v5

Only v-prefixed version tags are considered; branch refs (@main), non-v tags, docker:// and local (./) actions are left untouched. Filtering (--include/--exclude/packageMode), the maturity-period cool-down, and mode all apply, matched by the action's owner/repo name.

Versions are fetched from the GitHub REST API. Set a GITHUB_TOKEN (or GH_TOKEN) to raise the rate limit from 60 to 5000 requests/hour:

GITHUB_TOKEN=xxxx taze major

If neither is set, taze falls back to a token from the GitHub CLI (gh auth token) when you're logged in, so an authenticated gh needs no extra configuration.

JSR

taze checks JSR dependencies alongside your npm ones. Both ways of declaring a JSR package are supported:

{
  "dependencies": {
    // native jsr: protocol (pnpm / deno) — versions come from jsr.io
    "@std/cli": "jsr:^1.0.0",
    // npm-compat form written by `npx/bunx jsr add` — needs `@jsr:registry=https://npm.jsr.io` in .npmrc
    "@std/encoding": "npm:@jsr/std__encoding@^1.0.0"
  }
}

jsr: specifiers are resolved against the JSR registry (yanked versions are skipped) and written back in place preserving the jsr: prefix. All modes, filtering, and -w apply as usual.

Node.js version

taze also keeps the Node.js version pinned in .node-version, .nvmrc, and a package.json devEngines.runtime entry fresh. It checks these files in the current directory, and with -r it discovers nested ones too (honoring ignorePaths); a neighboring package.json is not required for the .node-version / .nvmrc files.

taze                    # stay on the current Node.js major
taze patch              # stay on the current major and minor
taze major -w           # allow a newer major and write the file
taze --no-node-version  # opt out

In .node-version / .nvmrc only stable numeric references with an optional v prefix are recognized (22, 22.14, v22.14.0); aliases (lts/*, node), ranges, and prereleases are left untouched. The written reference keeps the shape you had — a major-only 22 stays major-only, and the v prefix, surrounding whitespace, and any comments/blank lines are preserved.

A devEngines.runtime pin whose name is node is instead treated as a semver range and rewritten in place, preserving the range operator (>=20 → >=26.7.0, ^20.0.0 → ^20.20.2); runtime may be a single object or an array (only the node entry is touched).

Releases and their dates come from the official Node.js distribution index, so maturityPeriod and version-specific exclusions apply here too.

readme truncated — read the full docs on github

Frequently asked questions

Is taze free to use?

taze is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does taze do?

🥦 A modern cli tool that keeps your deps fresh

What is taze written in?

taze is primarily written in TypeScript. Its source is publicly available at https://github.com/antfu-collective/taze, and it has 4,283 GitHub stars.