# npm-check-updates: what changed from 22 to 23

- Product: npm-check-updates (https://whatsnew.fyi/product/npm-check-updates)
- Vendor: npm-check-updates
- Range: changelog entries numbered after v22.2.9 up to and including v23.1.0, stable releases only
- Entries below: 4 releases (newest first)
- Resolved: 22 is v22.2.9 and 23 is v23.1.0, the newest stable release of each major we track
- Carrying security changes: 0 · CVEs mentioned: 0 · Mentioning breaking changes: 1 · Removing or deprecating something: 1
- Page: https://whatsnew.fyi/product/npm-check-updates/compare/22...23

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## What changed (48 changes, grouped by kind)

### Added

#### v23.1.0 (2026-08-23)

- Add --interactiveSelect option to control which upgrades are pre-selected in interactive mode, with values: auto (default), none, patch, minor, or all

#### v23.0.0 (2026-07-26)

- Native TypeScript loading support

### Changed

#### v23.1.0 (2026-08-23)

- Strip terminal escape sequences from package and registry text
- Select the pnpm global config by the installed major version
- Read registries from pnpm-workspace.yaml
- Run getOwnerPerDependency at --concurrency
- Pass color through to the package manager spawn in doctor command
- Apply boolean false from the rc config as --no-<option>

#### v23.0.2 (2026-08-07)

- Lazily construct the RelativeTimeFormat to avoid eager ICU init on startup
- doctor: respect --no-color and NO_COLOR when spawning the package manager
- Shorten long build metadata in the upgrades table
- Keep the resolved version when the peer recursion requeries
- Select pnpm global minimumReleaseAge config by installed major version

#### v23.0.1 (2026-08-02)

- Replace timeago.js with the native Intl.RelativeTimeFormat
- Replace libnpmconfig and figgy-pudding with an in-house npm config loader
- Update dependencies
- Pin Docker base image by digest

#### v23.0.0 (2026-07-26)

- Minimum supported Node.js version is now 22; supported versions are ^22.22.2 || ^24.15.0 || >=26.0.0 (and npm >=10)
- Default export is now callable directly as ncu()
- Output is now grouped by default; use --format no-group to get flat output
- --target semver now respects explicit upper bounds in version ranges
- npm-registry-fetch is now lazy-loaded for faster startup

### Fixed

#### v23.1.0 (2026-08-23)

- Do not let rejectOnError:false swallow spawn errors
- Warn when peer dependency lookups fail instead of silently disabling --peer
- Reject invalid values in array options
- Fix operator precedence in the invalid filter message
- Replace the github url version tag only in the fragment
- Fix pnpm global and prefix args being spread into single characters
- Restrict yaml catalog upgrades to catalog paths
- Only log the merged yarn config when it is not empty
- Fix --no-color being ignored
- Fix crash when a dist-tag points to a version missing from the packument

#### v23.0.2 (2026-08-07)

- Handle unexpected pnpm ls -g output
- Fix Wildcard case
- Report npm's stderr and the real command when npm ls outputs no JSON
- Bound the yarn info line regex and skip non-matching lines
- Resolve npm dist-tags
- Fix unreachable error classification in queryVersions
- Handle the peerDependencies array that npm 12 outputs

#### v23.0.0 (2026-07-26)

- Scoped package 404s with encoded @ character
- --doctor and --errorLevel 2 crash
- Registry settings ignored by --enginesNode and --ownerChanged
- YAML catalog preservation
- Abort packument stream once required fields are parsed for better performance
- CLI options being overridden by .ncurc in --deep mode
- Upgrade a package in all selected sections when versions differ

### Removed

#### v23.0.0 (2026-07-26)

- CommonJS build dropped; package is now pure ESM only
- filterVersion and rejectVersion options no longer accept predicate functions; use filter or reject instead

## Release notes

### v23.1.0

- Date: 2026-08-23
- Version: v23.1.0
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v23.1.0
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v23.1.0

- **added** — Add --interactiveSelect option to control which upgrades are pre-selected in interactive mode, with values: auto (default), none, patch, minor, or all
- **changed** — Strip terminal escape sequences from package and registry text
- **changed** — Select the pnpm global config by the installed major version
- **changed** — Read registries from pnpm-workspace.yaml
- **changed** — Run getOwnerPerDependency at --concurrency
- **changed** — Pass color through to the package manager spawn in doctor command
- **changed** — Apply boolean false from the rc config as --no-<option>
- **fixed** — Do not let rejectOnError:false swallow spawn errors
- **fixed** — Warn when peer dependency lookups fail instead of silently disabling --peer
- **fixed** — Reject invalid values in array options
- **fixed** — Fix operator precedence in the invalid filter message
- **fixed** — Replace the github url version tag only in the fragment
- **fixed** — Fix pnpm global and prefix args being spread into single characters
- **fixed** — Restrict yaml catalog upgrades to catalog paths
- **fixed** — Only log the merged yarn config when it is not empty
- **fixed** — Fix --no-color being ignored
- **fixed** — Fix crash when a dist-tag points to a version missing from the packument

##### Added new option: `--interactiveSelect`

Usage:

```sh
ncu -i --interactiveSelect [value]
```

Default: auto

Control which upgrades are pre-selected in interactive mode. Only applies with `--interactive`.

<table>
  <tr><td>auto</td><td>Pre-selects patch and minor upgrades with <code>--format group</code>, which is enabled by default, and all upgrades otherwise. This is what <code>ncu -i</code> does. (default)</td></tr>
  <tr><td>none</td><td>Nothing is pre-selected.</td></tr>
  <tr><td>patch</td><td>Patch upgrades are pre-selected.</td></tr>
  <tr><td>minor</td><td>Patch and minor upgrades are pre-selected.</td></tr>
  <tr><td>all</td><td>All upgrades are pre-selected, including major.</td></tr>
</table>

Specify `auto` explicitly to restore the default when another value is set in your [config file](#config-file).

Major version zero upgrades (e.g. 0.1.0 → 0.2.0) are only pre-selected by `all`, since anything may change before 1.0.0. Custom groups returned by [--groupFunction](#groupfunction) are likewise only pre-selected by `all`.

##### Other Changes
* LICENSE: use clean GPL-2.0 by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1979
* Strip terminal escape sequences from package and registry text by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1994
* Select the pnpm global config by the installed major version by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1995
* Do not let rejectOnError:false swallow spawn errors by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1997
* Warn when peer dependency lookups fail instead of silently disabling `--peer` by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1984
* Test getModuleMismatchError directly instead of through a real config load by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1998
* Further e2e.sh improvements by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1993
* Update dependencies by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1992
* Wrap option default values in code tags by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2001
* Always run the deep test CLI from build by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2000
* Reject invalid values in array options by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2002
* doctor: pass color through to the package manager spawn by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2003
* Fix operator precedence in the invalid filter message by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2004
* Replace the github url version tag only in the fragment by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2005
* Clean up misleading names and dead code in npm, logging and filterAndReject by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2006
* Fix pnpm global and prefix args being spread into single characters by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2007
* Apply boolean false from the rc config as --no-<option> by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2008
* Restrict yaml catalog upgrades to catalog paths by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2009
* Only log the merged yarn config when it is not empty by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2010
* Fix --no-color being ignored by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2013
* Run getOwnerPerDependency at --concurrency by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2017
* Fix crash when a dist-tag points to a version missing from the packument by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/2011
* Fix two rc-config tes

_[Truncated at 4000 characters — full notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v23.1.0]_

### v23.0.2

- Date: 2026-08-07
- Version: v23.0.2
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v23.0.2
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v23.0.2

- **fixed** — Handle unexpected pnpm ls -g output
- **changed** — Lazily construct the RelativeTimeFormat to avoid eager ICU init on startup
- **fixed** — Fix Wildcard case
- **fixed** — Report npm's stderr and the real command when npm ls outputs no JSON
- **changed** — doctor: respect --no-color and NO_COLOR when spawning the package manager
- **fixed** — Bound the yarn info line regex and skip non-matching lines
- **changed** — Shorten long build metadata in the upgrades table
- **fixed** — Resolve npm dist-tags
- **changed** — Keep the resolved version when the peer recursion requeries
- **fixed** — Fix unreachable error classification in queryVersions
- **fixed** — Handle the peerDependencies array that npm 12 outputs
- **changed** — Select pnpm global minimumReleaseAge config by installed major version

##### What's Changed
* Handle unexpected `pnpm ls -g` output by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1958
* Lazily construct the RelativeTimeFormat to avoid eager ICU init on startup by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1960
* Fix Wildcard case by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1963
* Update dependencies by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1967
* Further e2e.sh improvements by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1961
* Report npm's stderr and the real command when npm ls outputs no JSON by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1959
* doctor: respect --no-color and NO_COLOR when spawning the package manager by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1970
* Bound the yarn info line regex and skip non-matching lines by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1971
* Fix npm casing in comments and rename hasWildCard by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1972
* build(deps-dev): bump chalk from 5.6.2 to 6.0.0 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1975
* Shorten long build metadata in the upgrades table by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1957
* Spawn tweaks by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1976
* CI cleanup and tweaks by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1962
* Resolve npm dist-tags by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1956
* Deprecate CHANGELOG.md by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1980
* Keep the resolved version when the peer recursion requeries by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1983
* Fix unreachable error classification in queryVersions by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1986
* Increase coverage by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1985
* Handle the peerDependencies array that npm 12 outputs by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1991
* e2e.sh: drop  the npm view retry by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1977
* Select pnpm global minimumReleaseAge config by installed major version by @raineorshine with @Copilot in https://github.com/raineorshine/npm-check-updates/pull/1969


**Full Changelog**: https://github.com/raineorshine/npm-check-updates/compare/v23.0.1...v23.0.2

### v23.0.1

- Date: 2026-08-02
- Version: v23.0.1
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v23.0.1
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v23.0.1

- **changed** — Replace timeago.js with the native Intl.RelativeTimeFormat
- **changed** — Replace libnpmconfig and figgy-pudding with an in-house npm config loader
- **changed** — Update dependencies
- **changed** — Pin Docker base image by digest

##### What's Changed
* Pin Docker base image by digest by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1947
* build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1950
* Add zizmor workflow by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1946
* Update LICENSE by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1952
* Delete the unused .github/screenshot.png by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1953
* Replace timeago.js with the native Intl.RelativeTimeFormat by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1936
* Doc fixes by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1955
* Update dependencies by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1954
* build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1965
* Replace libnpmconfig and figgy-pudding with an in-house npm config loader by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1934


**Full Changelog**: https://github.com/raineorshine/npm-check-updates/compare/v23.0.0...v23.0.1

### v23.0.0

- Date: 2026-07-26
- Version: v23.0.0
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v23.0.0
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v23.0.0

- **changed** — Minimum supported Node.js version is now 22; supported versions are ^22.22.2 || ^24.15.0 || >=26.0.0 (and npm >=10)
- **removed** — CommonJS build dropped; package is now pure ESM only
- **changed** — Default export is now callable directly as ncu()
- **removed** — filterVersion and rejectVersion options no longer accept predicate functions; use filter or reject instead
- **changed** — Output is now grouped by default; use --format no-group to get flat output
- **changed** — --target semver now respects explicit upper bounds in version ranges
- **added** — Native TypeScript loading support
- **changed** — npm-registry-fetch is now lazy-loaded for faster startup
- **fixed** — Scoped package 404s with encoded @ character
- **fixed** — --doctor and --errorLevel 2 crash
- **fixed** — Registry settings ignored by --enginesNode and --ownerChanged
- **fixed** — YAML catalog preservation
- **fixed** — Abort packument stream once required fields are parsed for better performance
- **fixed** — CLI options being overridden by .ncurc in --deep mode
- **fixed** — Upgrade a package in all selected sections when versions differ

###### ⚠️ Breaking changes & migration

**1. Node.js 22+ required** (#1844)
The minimum supported Node.js is now **22**. Supported versions: `^22.22.2 || ^24.15.0 || >=26.0.0` (and npm `>=10`).
- *Migration:* Upgrade Node before installing. On older Node, stay on v22.x.

**2. Pure ESM package — CJS build dropped, default export is now callable** (#1916, #1894)
The package is now pure ESM (no more CommonJS build), and the default export is now callable directly. `ncu.run()` and `ncu.defineConfig()` still work as namespaced properties.
- *Migration (ESM):*
  ```js
  // before
  import * as ncu from 'npm-check-updates'
  const upgraded = await ncu.run({ /* ... */ })
  // after
  import ncu from 'npm-check-updates'
  const upgraded = await ncu({ /* ... */ }) // ncu.run({...}) also still works
  ```
- *Migration (CommonJS):* Still usable via Node's native `require()` of ESM (Node 22+), but the import shape changed:
  ```js
  // before
  const ncu = require('npm-check-updates')
  // after
  const { default: ncu } = require('npm-check-updates')
  ncu({ /* ... */ }).then(upgraded => console.log(upgraded))
  ```

**3. `filterVersion` / `rejectVersion` no longer accept a predicate function. Use `filter` / `reject` instead.** (#1933)
These options now accept only a string, wildcard, glob, comma/space-delimited list, or `/regex/`. (CLI usage is unchanged — the CLI never supported functions.)
- *Migration:* If you passed a function to `filterVersion`/`rejectVersion` in `.ncurc.js` or via the module API, move it to `filter` / `reject` instead. Those receive the package name **and** the parsed current version, so they can match on both:
  ```js
  // before
  filterVersion: (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
  // after
  filter:        (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
  ```

**4. Output is now grouped by default** (#1937)
`--format` now defaults to `["group"]`, so upgrades are grouped by major / minor / patch out of the box. This is a better default for most users.
- *Migration:* To get the old flat output, use:
  ```bash
  ncu --format no-group
  ```
  The new `no-` prefix removes a value from the default list instead of replacing the whole list, so `--format no-group,time` disables grouping while adding publish times.

**5. `--target semver` now respects explicit upper bounds** (#1920)
An explicit upper bound in a range is now preserved and never exceeded, e.g. `^9.5.0 <10` → `^9.7.0 <10` (previously the bound could be overrun). This can change which versions are selected for ranges with explicit upper bounds.

###### ✨ Other improvements
- Native TypeScript loading (#1888), lazy-loaded `npm-registry-fetch` for faster startup (#1898), and reduced dependencies for a lighter install.
- Numerous bug fixes: scoped-package 404s with encoded `@` (#1923), `--doctor` + `--errorLevel 2` crash (#1900), registry settings ignored by `--enginesNode`/`--ownerChanged` (#1925), and YAML catalog preservation (#1922), abort packument stream once required fields are parsed (#1901) for better performance, fix cli options being overridden by .ncurc in --deep mode (#1902), and upgrade a package in all selected sections when versions differ.

**Full changelog:** https://github.com/raineorshine/npm-check-updates/compare/v22.2.9...v23.0.0