Settings

Configuration

Ripedeps has two settings that belong with a project: how old a version must be, and how big a step it may take. Keep them in package.json, and every way in uses them.

The ripedeps entry

A top-level ripedeps object in your package.json, in the spirit of nodemonConfig:

package.json

"ripedeps": {
  "minAgeDays": 7,
  "maxBump": "minor"
}

minAgeDays: the age gate, a whole number from 0 to 365.
maxBump: the largest step, patch, minor or major.

Nothing else can be set there. focus is a per-call filter and only comes from the request, and the limits and skipAdoptConfig are not file settings.

Which value wins

For each setting, separately:

a value you send with the request (the form control, the API or MCP parameter, the script flag),
then the value in the ripedeps entry of the file,
then the default.

Only a value you really send counts. The API, the MCP tool and the script do not fill in defaults for what you left out, so the entry can apply. The answer tells you where each value came from: meta.settings has a source of request, file or default for both settings.

Defaults

Setting	API, MCP, script	Web tool
`minAgeDays`	`0`	`7` (options 0, 3, 7, 14, 30)
`maxBump`	`minor`	`minor`
`skipAdoptConfig`	`false`	`true` ("Remember the ripedeps settings in package.json" is off)

The web tool sends its controls explicitly. When a loaded file has a valid ripedeps entry, the age and step controls are pre-filled from it, and you can still change them. The compact form on the home page starts at 0 days. See the request parameters for the complete list.

Writing the entry back

By default the new package.json that comes back carries a ripedeps entry with the settings of that call, so the next run, from any way in, uses the same ones. If the entry is not there it is added as the last top-level key with your indentation. If it is there it is updated in place and unknown keys stay.

Send skipAdoptConfig (script: --skip-adoptconfig) to leave the file's entry exactly as it is: not added, not changed, not removed. An existing entry is still read.

Because the entry is written, the first call on a file without it gives a non-empty diff even when no version changes. A job that fails when the diff is not empty should send skipAdoptConfig, as in the CI guide. Writing the entry alone does not count as an upgrade.

Invalid and unknown keys

A ripedeps value that is not an object, or a known key with an invalid value, is an error: 400 invalid_ripedeps_config, and the message names the key.
Any other key, focus included, is ignored for the calculation, kept as it is in the output and reported as a warning. For focus the warning says it is not supported in the entry.

Read from the file

One more thing is taken from your package.json without any setting: engines.node. Versions that need a newer Node than your lowest supported one are not proposed, and @types/node follows it. See @types and engines.node.

There is no setting for lockfiles, exceptions, vulnerabilities or new @types entries. The reasons are in the FAQ.