[RRFC] Add semver filter to the outdated command

[lomby92]

Motivation ("The Why")

I was managing a repository and wanted to see if there were any new major releases in the dependencies. I was interested only to major releases changes but the npm outdated command showed to me also minor and patch changes.

Example

Allow to show only some specific type of semver changes, eg: only major and minor.

How

Current Behaviour

The npm outdated command shows all dependencies with an update

Desired Behaviour

Allow to specify a filter parameter like --include-versions that takes as input a string or a list of comma-separated strings.

Example:

npm outdated

Package      Current          Wanted        Latest
dep1         1.0.1            1.0.1         1.1.0
dep2         3.2.122          3.2.122       4.0.0
dep1         0.0.1            0.0.1         0.0.2


npm outdated --include-versions major,minor

Package      Current          Wanted        Latest
dep1         1.0.1            1.0.1         1.1.0
dep2         3.2.122          3.2.122       4.0.0

References

• n/a

[ljharb]

In the last example, the “1” is a major version. In vX.Y.Z, v0.X.Y, and v0.0.X, x is the major, y the minor, and z the patch.

[lomby92]

https://semver.org/

I always used: major.minor.patch

[ljharb]

See https://semver.org/spec/v1.0.0.html - the npm ecosystem generally uses the rubric I described.

[lomby92]

I have not found what you say, not even in this document. Can you show me where the quote is?

[ljharb]

https://semver.org/spec/v1.0.0.html#spec-item-6 says there are no non-breaking change before v1. the undocumented convention the npm ecosystem uses, and the way npm itself works with ^ and ~ (ranges it defines, that are not in the specification) work the way I described.

[lomby92]

So? Even if NPM uses an internal convention, the proposal could be good to be added, no?

In that case, if a package moves from 0.0.1 to 0.0.2 it should be interpreted as a major change. Or, if moving from 0.1.4 to 0.1.5: it's a minor change.

This behaviour should be consistent with the undocumented way NPM works

[ljharb]

Yes, 0.0.1 to 0.0.2 is a major change; and 0.1.4 to 0.1.5 is a minor change, and npm should and does work this way with the ~ and ^ range operators.

[lomby92]

Ok, the next step is to open a PR with my RFC. Is it right?

[ljharb]

I think it’s probably best to wait until query has landed, since that’s how it’d be implemented and would affect the api.

[lomby92]

Is that RFC? https://github.com/npm/rfcs/pull/564 (if it's, seems to be really interesting)