updates

updates

updates is a CLI tool that checks for dependency updates, usually in under a second.

Supported files

• package.json, pnpm-workspace.yaml - npm dependencies
• pyproject.toml - uv dependencies
• go.mod, go.work - go dependencies
• Cargo.toml - rust dependencies, including workspaces
• .{github,gitea,forgejo}/workflows - actions and docker images
• Dockerfile*, compose*.{yml,yaml}, docker-*.{yml,yaml} - docker images
• Makefile, *.mk - go tool versions in go install paths and docker image tags

Usage

# check for updates
npx updates

# update package.json and install new dependencies
npx updates -u && npm i

Options

Options taking multiple arguments accept comma-separated values or repetition. An option with an optional dep argument applies to all dependencies when the argument is omitted. dep matches globs like foo* or regexes wrapped in slashes like '/^foo/', except for --pin, which takes an exact name.

A failed lookup is reported on its own, does not hold back the other results and exits with code 1, ahead of -E and -U. With -j, failures are listed in an errors array next to results.

Config File

Configure via updates.config.{ts,js,mjs,mts}. Each manifest uses the nearest config above it, and workspace members use the workspace root config. CLI arguments win over configured values, including include, exclude and pin.

import type {Config} from "updates";

export default {
  pin: {
    "typescript": "^6",
  },
} satisfies Config;

Config Options

Mirrors the CLI options in camelCase, with --file as files, plus:

• overrides Array<Override>: Per-package option overrides (see Overrides)
• inherit object: Fields to inherit from other tools' configs (see Renovate config)

include, exclude and the dep options take Array<string | RegExp>, pin takes a Record<string, string> keyed by exact dependency name, files and modes take Array<string>.

Overrides

overrides applies options to a subset of dependencies. Each entry takes include and/or exclude patterns, omit include to match all, plus any of cooldown, greatest, prerelease, release, patch, minor, allowDowngrade. An override beats the top-level option and the last match wins.

import type {Config} from "updates";

export default {
  cooldown: "7d",
  overrides: [
    {include: ["@myorg/*"], cooldown: 0},      // no cooldown for your own scope
    {include: [/^@aws-sdk/], cooldown: "14d"}, // longer cooldown for a noisy publisher
    {exclude: ["typescript"], greatest: true}, // greatest for everything but typescript
  ],
} satisfies Config;

Renovate config

A Renovate renovate.json, renovate.jsonc or renovate.json5 is picked up automatically, inheriting ignoreDeps, enabled and allowedVersions from matching local packageRules as include/exclude/pin. Exact-name allowedVersions ranges become pin ceilings that never downgrade. Local fields are imported when extends is present, but preset contents are not resolved. minimumReleaseAge is not inherited unless opted in:

export default {
  inherit: {
    renovate: {cooldown: true},
  },
} satisfies Config;

Values in updates.config override anything inherited.

API

updates can be used as a library and accepts all config options:

import {updates} from "updates";

const output = await updates({
  files: ["package.json"],
  include: [/^react/],
  modes: ["npm"],
});
//=> {
//=>   "results": {
//=>     "npm": {
//=>       "dependencies": {
//=>         "react": {
//=>           "old": "18.0.0",
//=>           "new": "19.2.0",
//=>           "info": "https://github.com/facebook/react",
//=>           "age": "2d"
//=>         }
//=>       }
//=>     }
//=>   }
//=> }

Environment Variables

A host in UPDATES_FORGE_TOKENS wins over the GitHub tokens. Any non-GitHub forge without a matching entry receives no credentials.

© silverwind, distributed under BSD licence