bump-deps

A dependency-update workflow for Node.js projects built around the taze CLI, with smart prompting so routine updates apply automatically while risky ones stay under human control. MINOR and PATCH updates are auto-applied, MAJOR updates are prompted individually, and fixed-version packages (those with no caret or tilde range prefix) are skipped entirely. It supports npm, pnpm, yarn, and bun, and can be scoped to specific packages via arguments that map to taze's --include flag.

The workflow runs through a ships-with helper script, run-taze.sh, invoked by absolute path from the target repository so taze scans the right project. Step 1 scans for updates (auto-detecting monorepos via workspaces or pnpm-workspace.yaml and enabling recursive mode); Step 2 categorizes each update as Fixed, PATCH, MINOR, or MAJOR; Steps 3-4 select MINOR/PATCH plus any auto-approved major packages and prompt for the rest using AskUserQuestion; Step 5 applies everything in one write command; Step 6 optionally updates Bun workspace catalogs; and Step 7 installs with ni, which auto-detects the package manager. A --dry-run mode stops after categorization and prints a single sorted markdown table of every discovered update (including skipped fixed versions) plus a one-line summary, without changing anything.

Use it for any dependency bump, whether updating packages, checking outdated ones, or running taze. It also honors package-manager minimum-release-age policies (bun's minimumReleaseAge, or pnpm/yarn equivalents) by passing taze's maturity-period flags so too-new releases are filtered out before manifests are written. Non-semver protocol specifiers such as workspace:, file:, link:, github:, and tarball URLs are never treated as updates and are left untouched throughout the categorization, dry-run table, and write list.