chore(deps): update dependency npm-check-updates to v23 by renovate[bot] · Pull Request #1883 · mx-space/kami

renovate · 2026-09-18T03:08:26Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
npm-check-updates	`^20.0.2` → `^23.1.0`

Release Notes

raineorshine/npm-check-updates (npm-check-updates)

`v23.1.0`

Compare Source

Added new option: `--interactiveSelect`

Usage:

ncu -i --interactiveSelect [value]

Default: auto

Control which upgrades are pre-selected in interactive mode. Only applies with --interactive.

auto	Pre-selects patch and minor upgrades with `--format group`, which is enabled by default, and all upgrades otherwise. This is what `ncu -i` does. (default)
none	Nothing is pre-selected.
patch	Patch upgrades are pre-selected.
minor	Patch and minor upgrades are pre-selected.
all	All upgrades are pre-selected, including major.

Specify auto explicitly to restore the default when another value is set in your config file.

Major version zero upgrades (e.g. 0.1.0 → 0.2.0) are only pre-selected by all, since anything may change before 1.0.0. Custom groups returned by --groupFunction are likewise only pre-selected by all.

Other Changes

LICENSE: use clean GPL-2.0 by @XhmikosR in #1979
Strip terminal escape sequences from package and registry text by @XhmikosR in #1994
Select the pnpm global config by the installed major version by @XhmikosR in #1995
Do not let rejectOnError:false swallow spawn errors by @XhmikosR in #1997
Warn when peer dependency lookups fail instead of silently disabling --peer by @XhmikosR in #1984
Test getModuleMismatchError directly instead of through a real config load by @XhmikosR in #1998
Further e2e.sh improvements by @XhmikosR in #1993
Update dependencies by @XhmikosR in #1992
Wrap option default values in code tags by @XhmikosR in #2001
Always run the deep test CLI from build by @XhmikosR in #2000
Reject invalid values in array options by @XhmikosR in #2002
doctor: pass color through to the package manager spawn by @XhmikosR in #2003
Fix operator precedence in the invalid filter message by @XhmikosR in #2004
Replace the github url version tag only in the fragment by @XhmikosR in #2005
Clean up misleading names and dead code in npm, logging and filterAndReject by @XhmikosR in #2006
Fix pnpm global and prefix args being spread into single characters by @XhmikosR in #2007
Apply boolean false from the rc config as --no- by @XhmikosR in #2008
Restrict yaml catalog upgrades to catalog paths by @XhmikosR in #2009
Only log the merged yarn config when it is not empty by @XhmikosR in #2010
Fix --no-color being ignored by @XhmikosR in #2013
Run getOwnerPerDependency at --concurrency by @XhmikosR in #2017
Fix crash when a dist-tag points to a version missing from the packument by @XhmikosR in #2011
Fix two rc-config tests that asserted nothing by @XhmikosR in #2020
Restore CHANGELOG.md and automate release-driven changelog sync by @raineorshine with @Copilot in #2014
Add min-release-age=7 to .npmrc by @XhmikosR in #2025
Remove the temp working directory created by the build-changelog tests by @XhmikosR in #2024
Update dependencies by @XhmikosR in #2023
feat(pnpm): read registries from pnpm-workspace.yaml by @smarlhens in #1973
feat: add --interactiveSelect to control pre-selected upgrades by @raineorshine in #2029

New Contributors

@smarlhens made their first contribution in #1973

Full Changelog: raineorshine/npm-check-updates@v23.0.2...v23.1.0

`v23.0.2`

Compare Source

What's Changed

Handle unexpected pnpm ls -g output by @XhmikosR in #1958
Lazily construct the RelativeTimeFormat to avoid eager ICU init on startup by @XhmikosR in #1960
Fix Wildcard case by @XhmikosR in #1963
Update dependencies by @XhmikosR in #1967
Further e2e.sh improvements by @XhmikosR in #1961
Report npm's stderr and the real command when npm ls outputs no JSON by @XhmikosR in #1959
doctor: respect --no-color and NO_COLOR when spawning the package manager by @XhmikosR in #1970
Bound the yarn info line regex and skip non-matching lines by @XhmikosR in #1971
Fix npm casing in comments and rename hasWildCard by @XhmikosR in #1972
build(deps-dev): bump chalk from 5.6.2 to 6.0.0 by @dependabot[bot] in #1975
Shorten long build metadata in the upgrades table by @XhmikosR in #1957
Spawn tweaks by @XhmikosR in #1976
CI cleanup and tweaks by @XhmikosR in #1962
Resolve npm dist-tags by @XhmikosR in #1956
Deprecate CHANGELOG.md by @XhmikosR in #1980
Keep the resolved version when the peer recursion requeries by @XhmikosR in #1983
Fix unreachable error classification in queryVersions by @XhmikosR in #1986
Increase coverage by @XhmikosR in #1985
Handle the peerDependencies array that npm 12 outputs by @XhmikosR in #1991
e2e.sh: drop the npm view retry by @XhmikosR in #1977
Select pnpm global minimumReleaseAge config by installed major version by @raineorshine with @Copilot in #1969

Full Changelog: raineorshine/npm-check-updates@v23.0.1...v23.0.2

`v23.0.1`

Compare Source

What's Changed

Pin Docker base image by digest by @XhmikosR in #1947
build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in #1950
Add zizmor workflow by @XhmikosR in #1946
Update LICENSE by @XhmikosR in #1952
Delete the unused .github/screenshot.png by @XhmikosR in #1953
Replace timeago.js with the native Intl.RelativeTimeFormat by @XhmikosR in #1936
Doc fixes by @XhmikosR in #1955
Update dependencies by @XhmikosR in #1954
build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in #1965
Replace libnpmconfig and figgy-pudding with an in-house npm config loader by @XhmikosR in #1934

Full Changelog: raineorshine/npm-check-updates@v23.0.0...v23.0.1

`v23.0.0`

Compare Source

⚠️ Breaking changes & migration

1. Node.js 22+ required (#1844)
The minimum supported Node.js is now 22. Supported versions: ^22.22.2 || ^24.15.0 || >=26.0.0 (and npm >=10).

Migration: Upgrade Node before installing. On older Node, stay on v22.x.

2. Pure ESM package — CJS build dropped, default export is now callable (#1916, #1894)
The package is now pure ESM (no more CommonJS build), and the default export is now callable directly. ncu.run() and ncu.defineConfig() still work as namespaced properties.

Migration (ESM):

// before
import * as ncu from 'npm-check-updates'
const upgraded = await ncu.run({ /* ... */ })
// after
import ncu from 'npm-check-updates'
const upgraded = await ncu({ /* ... */ }) // ncu.run({...}) also still works

Migration (CommonJS): Still usable via Node's native require() of ESM (Node 22+), but the import shape changed:

// before
const ncu = require('npm-check-updates')
// after
const { default: ncu } = require('npm-check-updates')
ncu({ /* ... */ }).then(upgraded => console.log(upgraded))

3. filterVersion / rejectVersion no longer accept a predicate function. Use filter / reject instead. (#1933)
These options now accept only a string, wildcard, glob, comma/space-delimited list, or /regex/. (CLI usage is unchanged — the CLI never supported functions.)

Migration: If you passed a function to filterVersion/rejectVersion in .ncurc.js or via the module API, move it to filter / reject instead. Those receive the package name and the parsed current version, so they can match on both:

// before
filterVersion: (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
// after
filter:        (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)

4. Output is now grouped by default (#1937)
--format now defaults to ["group"], so upgrades are grouped by major / minor / patch out of the box. This is a better default for most users.

Migration: To get the old flat output, use:
```
ncu --format no-group
```
The new no- prefix removes a value from the default list instead of replacing the whole list, so --format no-group,time disables grouping while adding publish times.

5. --target semver now respects explicit upper bounds (#1920)
An explicit upper bound in a range is now preserved and never exceeded, e.g. ^9.5.0 <10 → ^9.7.0 <10 (previously the bound could be overrun). This can change which versions are selected for ranges with explicit upper bounds.

✨ Other improvements

Native TypeScript loading (#1888), lazy-loaded npm-registry-fetch for faster startup (#1898), and reduced dependencies for a lighter install.
Numerous bug fixes: scoped-package 404s with encoded @ (#1923), --doctor + --errorLevel 2 crash (#1900), registry settings ignored by --enginesNode/--ownerChanged (#1925), and YAML catalog preservation (#1922), abort packument stream once required fields are parsed (#1901) for better performance, fix cli options being overridden by .ncurc in --deep mode (#1902), and upgrade a package in all selected sections when versions differ.

Full changelog: raineorshine/npm-check-updates@v22.2.9...v23.0.0

`v22.2.9`

Compare Source

What's Changed

Dockerfile: use lts-alpine image by @XhmikosR in #1862
Rename variable and test file by @XhmikosR in #1884
eslint.config.js: drop moot jest globals by @XhmikosR in #1887
replace zod with valibot to reduce bundle size by @XhmikosR in #1885
CI: add prettier in lint workflow by @XhmikosR in #1889
Use async glob instead of glob.sync in getAllPackages by @XhmikosR in #1891
Minor type tweaks by @XhmikosR in #1892
Switch mocha tests to parallel by @XhmikosR in #1886
Replace markdownlint-cli with markdownlint-cli2 by @XhmikosR in #1893

Full Changelog: raineorshine/npm-check-updates@v22.2.8...v22.2.9

`v22.2.8`

Compare Source

What's Changed

CI: remove concurrency by @XhmikosR in #1846
build(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @dependabot[bot] in #1872
Downgrade ts-json-schema-generator to v2.4.0 for Node.js 20 support by @XhmikosR in #1848
prepare: add exit 0 as an extra guard by @XhmikosR in #1850
ESLint: bump to es2023 globals by @XhmikosR in #1854
package.json: remove redundant tests from files by @XhmikosR in #1855
tsconfig: enable verbatimModuleSyntax by @XhmikosR in #1860
Remove the unused libnpmconfig.d.ts by @XhmikosR in #1857
Clean up run() return type JSDoc by @XhmikosR in #1868
cache test: remove any previous stale cache file to prevent failures by @XhmikosR in #1865
package.json: remove duplicate typecheck script by @XhmikosR in #1856
Doctor tests cleanup by @XhmikosR in #1869
fix: skip cache write when cooldown is active by @XhmikosR in #1871
Fix stale @param names in JSDoc by @XhmikosR in #1874
Simplify tsconfig.json by @XhmikosR in #1858
Add a .npmrc file enabling engine-strict by @XhmikosR in #1847
Enforce node: protocol and dedupe imports by @XhmikosR in #1842
Fix verbose log printing local yarn config under "user yarn config" header by @XhmikosR in #1875
lint: add --continue-on-error by @XhmikosR in #1859
test: cover $ override references by @XhmikosR in #1877
CI updates by @XhmikosR in #1870
More shell tweaks by @XhmikosR in #1853
Update interactive hint for q button by @XhmikosR in #1879
Vite config cleanup by @XhmikosR in #1861
package.json: remove unneeded overrides by @XhmikosR in #1849
build: stub unused iconv-lite out of the bundle by @XhmikosR in #1881
package.json: specify allowScripts by @XhmikosR in #1878
build(deps): bump softprops/action-gh-release by @dependabot[bot] in #1880
refactor prettifyCooldown and share the cooldown regex by @XhmikosR in #1883
build(deps-dev): bump the development-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #1876
fix(cooldown): scope auto-cooldown config to active package manager only by @raineorshine with @Copilot in #1882

Full Changelog: raineorshine/npm-check-updates@v22.2.7...v22.2.8

`v22.2.7`

Compare Source

What's Changed

Fix CodeQL issues by @XhmikosR in #1813
Escape package name and reuse escapeRegExp by @XhmikosR in #1838
Remove redundant awaits and enable @typescript-eslint/await-thenable by @XhmikosR in #1839
Stop exporting the externally unused getOwnerPerDependency by @XhmikosR in #1840
Perf improvements by @XhmikosR in #1843
Move configs out of package.json by @XhmikosR in #1841
build(deps): downgrade ini from 7.0.0 to 6.0.0 to restore Node 20 support by @raineorshine in #1845

Full Changelog: raineorshine/npm-check-updates@v22.2.6...v22.2.7

`v22.2.6`

Compare Source

What's Changed

build(deps-dev): bump @typescript-eslint/eslint-plugin by @dependabot[bot] in #1787
build(deps-dev): bump @typescript-eslint/parser from 8.60.1 to 8.61.0 by @dependabot[bot] in #1788
build(deps-dev): bump @microsoft/api-extractor from 7.58.7 to 7.58.8 by @dependabot[bot] in #1789
build(deps-dev): bump eslint-plugin-n from 18.0.1 to 18.1.0 by @dependabot[bot] in #1790
build(deps-dev): bump prettier from 3.8.3 to 3.8.4 by @dependabot[bot] in #1792
build(deps-dev): bump semver from 7.8.2 to 7.8.3 by @dependabot[bot] in #1793
build(deps-dev): bump cosmiconfig from 9.0.1 to 9.0.2 by @dependabot[bot] in #1791
build(deps-dev): bump shell-quote from 1.8.3 to 1.8.4 by @dependabot[bot] in #1795
Dependabot: add github-actions updates and group updates with a cooldown by @XhmikosR in #1785
CI: harden and align GitHub Actions workflows by @XhmikosR in #1786
feat: respect min-release-age-exclude with min-release-age npm config by @Cherry in #1797
feat: add Claude Code SKILL file for npm-check-updates by @ilteoood in #1798
build(deps): bump esbuild from 0.28.0 to 0.28.1 by @dependabot[bot] in #1799
Quote global package specs with a period in the scope for PowerShell compatibility by @raineorshine with @Copilot in #1800
Add a GitHub workflow to clean up closed PRs' caches by @XhmikosR in #1804
package.json: fix npm scripts to be cross-platform by @XhmikosR in #1805
Replace the unmaintained npm-run-all with npm-run-all2 and removed unused deps by @XhmikosR in #1806
build workflow: add npm pack --dry-run by @XhmikosR in #1807
test/e2e.sh: fix shellcheck issues by @XhmikosR in #1808
Replace rfdc with native structuredClone by @XhmikosR in #1809
Replace js-yaml with yaml by @XhmikosR in #1810
Replace dequal with node:util isDeepStrictEqual by @XhmikosR in #1811
fix: do not call semver.minVersion on non-semver package protocols by @duniul in #1767
Convert inline code backticks to <code> in generated HTML tables by @XhmikosR in #1814
Fix skills by @XhmikosR in #1815
Vite: use 'oxc' for minify by @XhmikosR in #1816
build(deps): bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in #1817
build-options.ts: split README and schema writes, drop duplicate RunOptions.json write by @XhmikosR in #1818
Remove lodash-es by @XhmikosR in #1819
Replace cosmiconfig with lilconfig by @XhmikosR in #1812
Remove redundant Promise.resolve in fetchUpgradedPackument by @XhmikosR in #1823
Switch to async/await in a few more places by @XhmikosR in #1824
Replace forEach with for...of by @XhmikosR in #1825
Yarn test fixes by @XhmikosR in #1828
fix padLeft adding trailing spaces to blank lines by @XhmikosR in #1829
Remove unused dev dependencies by @XhmikosR in #1820
fix: replace async reduce with for-of loop in --deep to avoid OOM by @XhmikosR in #1831
test.yml: remove redundant permissions block by @XhmikosR in #1832
fix MaxListenersExceededWarning when calling run() repeatedly by @XhmikosR in #1833
fix: resolve workspace paths relative to --packageFile dir, not cwd by @XhmikosR in #1834
fix: inline semver-utils types in the d.ts rollup by @XhmikosR in #1835
Drop rimraf in favor of Vite emptyOutDir by @XhmikosR in #1821
CI: add Node.js 26 by @XhmikosR in #1836
CI tweaks by @XhmikosR in #1837
Move src/scripts to the root folder by @XhmikosR in #1827

New Contributors

@ilteoood made their first contribution in #1798
@duniul made their first contribution in #1767

Full Changelog: raineorshine/npm-check-updates@v22.2.5...v22.2.6

`v22.2.5`

Compare Source

e951cf4 Bump minor and patch.
0f9f53d prettier
edf4212 Make deep tests path-agnostic with regex patterns
b820131 Only show missing time when time or cooldown format is requested

Full Changelog: raineorshine/npm-check-updates@v22.2.3...v22.2.5

`v22.2.3`

Compare Source

What's Changed

build(deps-dev): bump semver from 7.8.0 to 7.8.1 by @dependabot[bot] in #1760
build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in #1781
build(deps-dev): bump unplugin-dts from 1.0.1 to 1.0.2 by @dependabot[bot] in #1780
build(deps-dev): bump eslint-import-resolver-typescript by @dependabot[bot] in #1779
build(deps-dev): bump tsx from 4.22.3 to 4.22.4 by @dependabot[bot] in #1778
fix: handle registries missing 'time' metadata during version resolution by @onemen in #1763
Fall back to pnpm global config for minimumReleaseAge cooldown by @Copilot in #1777

Full Changelog: raineorshine/npm-check-updates@v22.2.2...v22.2.3

`v22.2.2`

Compare Source

What's Changed

test: use node util to strip ansi in deep test by @terminalchai in #1769
build(deps-dev): bump vite from 8.0.13 to 8.0.16 by @dependabot[bot] in #1774
Switch from vite-plugin-dts to unplugin-dts by @Copilot in #1749
test: remove unused temp directory creation by @terminalchai in #1770
test: cover Windows spawn command fallback by @terminalchai in #1771
build(deps-dev): bump sinon from 21.1.2 to 22.0.0 by @dependabot[bot] in #1751
fix: parse Yarn duration string format for npmMinimalAgeGate by @Copilot in #1768
build(deps-dev): bump @types/bun from 1.3.13 to 1.3.14 by @dependabot[bot] in #1754
build(deps-dev): bump @typescript-eslint/parser from 8.59.4 to 8.60.1 by @dependabot[bot] in #1773
build(deps-dev): bump mocha from 11.7.5 to 11.7.6 by @dependabot[bot] in #1753
build(deps-dev): bump verdaccio from 6.6.0 to 6.7.2 by @dependabot[bot] in #1759

Full Changelog: raineorshine/npm-check-updates@v22.2.1...v22.2.2

`v22.2.1`

Compare Source

What's Changed

build(deps-dev): bump @typescript-eslint/eslint-plugin by @dependabot[bot] in #1727
build(deps-dev): bump verdaccio from 6.5.2 to 6.6.0 by @dependabot[bot] in #1728
build(deps-dev): bump yaml from 2.8.4 to 2.9.0 by @dependabot[bot] in #1729
fix: normalize blank-line spacing between packages in --deep mode by @terminalchai in #1738
Fix TypeError when running ncu from a subdirectory without a package.json by @Copilot in #1737
build(deps-dev): bump semver from 7.7.4 to 7.8.0 by @dependabot[bot] in #1731
build(deps-dev): bump ini from 6.0.0 to 7.0.0 by @dependabot[bot] in #1726
build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.59.3 to 8.59.4 by @dependabot[bot] in #1739
build(deps-dev): bump vite from 8.0.9 to 8.0.13 by @dependabot[bot] in #1740
build(deps-dev): bump tsx from 4.21.0 to 4.22.3 by @dependabot[bot] in #1741
build(deps-dev): bump @typescript-eslint/parser from 8.59.3 to 8.59.4 by @dependabot[bot] in #1743
build(deps-dev): bump @types/node from 25.6.0 to 25.9.1 by @dependabot[bot] in #1744
build(deps-dev): bump vite-plugin-dts from 4.5.4 to 5.0.0 by @dependabot[bot] in #1713
build(deps-dev): bump @eslint/compat from 2.0.5 to 2.1.0 by @dependabot[bot] in #1732

Full Changelog: raineorshine/npm-check-updates@v22.2.0...v22.2.1

`v22.2.0`

Compare Source

What's Changed

build(deps): bump fast-uri from 3.1.0 to 3.1.2 by @dependabot[bot] in #1724
feat: add cooldown format and improved visibility for skipped updates by @onemen in #1711

Full Changelog: raineorshine/npm-check-updates@v22.1.1...v22.2.0

`v22.1.1`

Compare Source

What's Changed

npm: decorateTagPackumentWithTimeAndName accepts undefined tagPackument by @SAY-5 in #1706
fix: skip intersects() for non-semver specs like catalog: in peer dep checks by @terminalchai in #1710
Bump yaml from 2.8.3 to 2.8.4 by @dependabot[bot] in #1714
Bump @typescript-eslint/eslint-plugin from 8.59.1 to 8.59.2 by @dependabot[bot] in #1716
Bump @typescript-eslint/parser from 8.59.1 to 8.59.2 by @dependabot[bot] in #1718
build(deps-dev): bump eslint-plugin-n from 17.24.0 to 18.0.1 by @dependabot[bot] in #1715
build(deps-dev): bump zod from 4.3.6 to 4.4.3 by @dependabot[bot] in #1719
build(deps-dev): bump globals from 17.5.0 to 17.6.0 by @dependabot[bot] in #1717
build(deps-dev): bump hosted-git-info from 9.0.2 to 9.0.3 by @dependabot[bot] in #1720

New Contributors

@SAY-5 made their first contribution in #1706

Full Changelog: raineorshine/npm-check-updates@v22.1.0...v22.1.1

`v22.1.0`

Compare Source

What's Changed

fix: make --dep and --format robust to PowerShell arg rewriting (comma-or-space-delimited) by @onemen in #1694
Bump @typescript-eslint/eslint-plugin from 8.59.0 to 8.59.1 by @dependabot[bot] in #1697
Bump eslint-plugin-promise from 7.2.1 to 7.3.0 by @dependabot[bot] in #1702
Bump @types/bun from 1.3.12 to 1.3.13 by @dependabot[bot] in #1699
Bump vite-bundle-analyzer from 1.3.7 to 1.3.8 by @dependabot[bot] in #1700
Enhance --format time: consistent caching, interactive support, and human-readable timestamps by @onemen in #1693
fix: ignore .pnpm-store in glob traversal to prevent OOM with --deep by @Copilot in #1705

Full Changelog: raineorshine/npm-check-updates@v22.0.1...v22.1.0

`v22.0.1`

Compare Source

What's Changed

fix: suppress cooldown config log messages when JSON output is active by @Copilot in #1692

Full Changelog: raineorshine/npm-check-updates@v22.0.0...v22.0.1

`v22.0.0`

Compare Source

`v21.0.3`

Compare Source

What's Changed

fix: chmod build/cli.js executable after vite build by @raineorshine in #1678
fix: migrate from rc-config-loader to cosmiconfig for ESM config support (closes #1674) by @onemen in #1676

Full Changelog: raineorshine/npm-check-updates@v21.0.2...v21.0.3

`v21.0.2`

Compare Source

What's Changed

fix: skip intersects() for non-semver specs like catalog: in peer dep checks by @terminalchai in #1675

Full Changelog: raineorshine/npm-check-updates@v21.0.1...v21.0.2

`v21.0.1`

Compare Source

What's Changed

fix: seeing catalog when inside workspaces by @Zamiell in #1656
Bump @types/bun from 1.3.11 to 1.3.12 by @dependabot[bot] in #1663
Bump globals from 17.4.0 to 17.5.0 by @dependabot[bot] in [#1664](https

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

safedep · 2026-09-18T03:08:30Z

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
`npm-check-updates @ 23.1.0` _{pnpm-lock.yaml}				🔗

View complete scan results →

_{This report is generated by SafeDep GitHub App}

github-actions · 2026-09-18T03:13:37Z