Update Strategies

Buddy provides flexible update strategies to control how dependencies are updated, allowing you to balance stability with staying current.

Overview

Update strategies determine which package versions buddy will suggest for updates. You can configure global strategies or set specific strategies for package groups.

Available Strategies

patch - Safest Updates

Updates only patch versions (bug fixes and security updates).

// Example: 1.2.3 → 1.2.4 (but not 1.3.0 or 2.0.0)
export default {
  packages: {
    strategy: 'patch'
  }
} satisfies BuddyConfig

When to use:

• Production applications requiring maximum stability
• Critical systems where breaking changes must be avoided
• Security-focused updates only

Example updates:

• [email protected] → [email protected] ✅
• [email protected] → [email protected] ❌
• [email protected] → [email protected] ❌

minor - Balanced Updates

Updates patch and minor versions (new features, backwards compatible).

// Example: 1.2.3 → 1.3.0 (but not 2.0.0)
export default {
  packages: {
    strategy: 'minor'
  }
} satisfies BuddyConfig

When to use:

• Most production applications
• Teams that want new features without breaking changes
• Gradual adoption of improvements

Example updates:

• [email protected] → [email protected] ✅ (patch)
• [email protected] → [email protected] ✅ (minor)
• [email protected] → [email protected] ❌ (major)

major - Latest Stable

Updates to the latest stable version, including major versions with breaking changes.

// Example: 1.2.3 → 2.0.0
export default {
  packages: {
    strategy: 'major'
  }
} satisfies BuddyConfig

When to use:

• Development environments
• Regular maintenance windows
• Teams comfortable with handling breaking changes

Example updates:

• [email protected] → [email protected] ✅ (patch)
• [email protected] → [email protected] ✅ (major)

all - Most Aggressive

Updates to the absolute latest version available, including pre-releases when no stable version exists.

export default {
  packages: {
    strategy: 'all'
  }
} satisfies BuddyConfig

When to use:

• Experimental projects
• Early adoption teams
• Testing latest features

Example updates:

• [email protected] → [email protected] ✅ (pre-release)
• [email protected] → [email protected] ✅ (beta)

Strategy Configuration

Global Strategy

Apply the same strategy to all packages:

export default {
  packages: {
    strategy: 'minor', // Applied to all packages
    ignore: ['react'] // Except ignored packages
  }
} satisfies BuddyConfig

Package Groups with Different Strategies

Use different strategies for different types of packages:

export default {
  packages: {
    strategy: 'patch', // Default strategy
    groups: [
      {
        name: 'Core Framework',
        patterns: ['react', 'react-dom', 'vue'],
        strategy: 'minor' // More conservative for core
      },
      {
        name: 'Development Tools',
        patterns: ['eslint', 'prettier', 'typescript'],
        strategy: 'major' // More aggressive for dev tools
      },
      {
        name: 'Testing Libraries',
        packages: ['jest', 'vitest', '@testing-library/*'],
        strategy: 'minor'
      }
    ]
  }
} satisfies BuddyConfig

Per-Package Strategy Override

Override strategy for specific packages:

export default {
  packages: {
    strategy: 'minor',
    rules: [
      { matchPackages: ['react'], strategy: 'patch' }, // Keep React very stable
      { matchPackages: ['typescript'], strategy: 'major' }, // Always latest TypeScript
      { matchPackages: ['@types/*'], strategy: 'all' } // Types can be aggressive
    ]
  }
} satisfies BuddyConfig

Rules are evaluated in order and later matches override earlier ones per field, so a broad rule can set a default and a narrow one refine it.

Smart Strategy Selection

Buddy automatically adjusts strategies based on package characteristics:

Security Updates

Advisories from OSV.dev are matched against your dependencies. With prioritize on, those updates are proposed ahead of routine ones and carry their own label, so a fix is not queued behind a batch of patch bumps:

export default {
  security: {
    enabled: true,
    prioritize: true,
    label: 'security',
    minimumSeverity: 'moderate' // 'low' | 'moderate' | 'high' | 'critical'
  },
  packages: {
    strategy: 'patch'
  }
} satisfies BuddyConfig

Security handling changes ordering and labelling, not the version range: an advisory whose fix is a minor release is still subject to the configured strategy. Widen strategy, or add a rule, if you want those to land.

Breaking Change Detection

Buddy analyzes changelogs and release notes to detect breaking changes:

const breakingConfig = {
  packages: {
    strategy: 'major',
    breakingChangeHandling: {
      requireApproval: true, // Require manual approval for breaking changes
      skipBeta: true, // Skip beta versions with breaking changes
      maxMajorJump: 1 // Only allow 1 major version jump at a time
    }
  }
}

Strategy Best Practices

Progressive Strategy

Start conservative and gradually increase aggressiveness:

// Week 1: Patch only
const week1Config = { strategy: 'patch' }

// Week 2: Add minor updates
const week2Config = { strategy: 'minor' }

// Week 3: Add major updates for dev dependencies
const week3Config = {
  strategy: 'minor',
  groups: [
    {
      name: 'Development',
      patterns: ['eslint', 'prettier', 'webpack'],
      strategy: 'major'
    }
  ]
}

Environment-Specific Strategies

Different strategies for different environments:

const isProduction = process.env.NODE_ENV === 'production'
const isCorporate = process.env.CORPORATE_ENVIRONMENT === 'true'

export default {
  packages: {
    strategy: isProduction
      ? (isCorporate ? 'patch' : 'minor')
      : 'major'
  }
} satisfies BuddyConfig

Ecosystem-Aware Strategies

Tailor strategies to specific ecosystems:

const config = {
  packages: {
    strategy: 'minor',
    groups: [
      {
        name: 'React Ecosystem',
        patterns: ['react*', '@react*'],
        strategy: 'minor' // React ecosystem moves together
      },
      {
        name: 'Node Types',
        patterns: ['@types/node'],
        strategy: 'patch' // Node types should match Node version
      },
      {
        name: 'Build Tools',
        packages: ['vite', 'rollup', 'esbuild'],
        strategy: 'major' // Build tools are less breaking
      }
    ]
  }
}

CLI Strategy Overrides

Override configuration strategies via CLI:

# Force patch strategy regardless of config
buddy update --strategy patch

# Use major strategy for specific packages
buddy update --strategy major --packages react,vue

# Mixed strategies
buddy update --patch typescript --minor react --major eslint

Monitoring Strategy Effectiveness

Track how strategies perform:

const monitoringConfig = {
  packages: {
    strategy: 'minor',
    monitoring: {
      trackFailures: true, // Track failed updates
      rollbackThreshold: 3, // Auto-rollback after 3 failures
      successRate: 0.95, // Require 95% success rate
      adaptStrategy: true // Auto-adjust strategy based on success
    }
  }
}

Common Strategy Patterns

Conservative Enterprise

export default {
  security: {
    enabled: true,
    prioritize: true,
    minimumSeverity: 'moderate'
  },
  packages: {
    strategy: 'patch',
    groups: [
      {
        name: 'Development Only',
        patterns: ['@types/*', 'eslint*', 'prettier'],
        strategy: 'minor'
      }
    ]
  }
} satisfies BuddyConfig

Balanced Team

export default {
  packages: {
    strategy: 'minor',
    groups: [
      {
        name: 'Core Dependencies',
        patterns: ['react', 'vue', 'angular'],
        strategy: 'patch'
      },
      {
        name: 'Development Tools',
        patterns: ['typescript', 'webpack', 'vite'],
        strategy: 'major'
      }
    ]
  }
} satisfies BuddyConfig

Aggressive Startup

export default {
  packages: {
    strategy: 'major',
    groups: [
      {
        name: 'Database & Infrastructure',
        patterns: ['prisma', 'mongoose', 'redis'],
        strategy: 'minor' // More careful with data layers
      }
    ]
  }
} satisfies BuddyConfig

Integration with Pull Requests

Strategies affect PR creation:

• Patch updates: Auto-mergeable, minimal review
• Minor updates: Standard review process
• Major updates: Require explicit approval, additional testing
• Security updates: High priority, expedited merge

See Pull Request Generation for more details on how strategies influence PR behavior.