NPM-level updatePolicy support

[castarco]

Is there an existing issue for this?

• I have searched the existing issues

Disclaimer

This feature request is a bit speculative, as nothing like this has been implemented for NPM yet; but I'd like to extend the discussion to other actors.

References

• [RRFC] New updatePolicy metadata section npm/rfcs#703 : The feature I proposed in NPM's RFCs repository.

Feature description

It would be nice to have an optional metadata section in package.json files to allow a more fine-grained control over how direct and transitive dependencies are updated, but also to help downstream consumers to decide how to update the package we maintain.

The main justification for this is that not everyone is respecting the semantic versioning convention, and we might benefit from more sophisticated mechanisms to keep under control the problems that arise from this fact.

From dependabot's perspective, the feature would consist on honouring that metadata in case it is present.