# npm-check-updates changelog

> npm-check-updates release notes.

- Vendor: npm-check-updates
- Category: Developer Tools
- Official site: https://github.com/raineorshine/npm-check-updates
- Tracked by: What's New (https://whatsnew.fyi/product/npm-check-updates)
- Harvested from: GitHub (raineorshine/npm-check-updates)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v23.0.1

- Date: 2026-08-02
- Version: v23.0.1
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v23.0.1
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v23.0.1

##### What's Changed
* Pin Docker base image by digest by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1947
* build(deps): bump the github-actions group with 4 updates by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1950
* Add zizmor workflow by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1946
* Update LICENSE by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1952
* Delete the unused .github/screenshot.png by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1953
* Replace timeago.js with the native Intl.RelativeTimeFormat by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1936
* Doc fixes by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1955
* Update dependencies by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1954
* build(deps): bump the github-actions group with 3 updates by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1965
* Replace libnpmconfig and figgy-pudding with an in-house npm config loader by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1934


**Full Changelog**: https://github.com/raineorshine/npm-check-updates/compare/v23.0.0...v23.0.1

### v23.0.0

- Date: 2026-07-26
- Version: v23.0.0
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v23.0.0
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v23.0.0

###### ⚠️ Breaking changes & migration

**1. Node.js 22+ required** (#1844)
The minimum supported Node.js is now **22**. Supported versions: `^22.22.2 || ^24.15.0 || >=26.0.0` (and npm `>=10`).
- *Migration:* Upgrade Node before installing. On older Node, stay on v22.x.

**2. Pure ESM package — CJS build dropped, default export is now callable** (#1916, #1894)
The package is now pure ESM (no more CommonJS build), and the default export is now callable directly. `ncu.run()` and `ncu.defineConfig()` still work as namespaced properties.
- *Migration (ESM):*
  ```js
  // before
  import * as ncu from 'npm-check-updates'
  const upgraded = await ncu.run({ /* ... */ })
  // after
  import ncu from 'npm-check-updates'
  const upgraded = await ncu({ /* ... */ }) // ncu.run({...}) also still works
  ```
- *Migration (CommonJS):* Still usable via Node's native `require()` of ESM (Node 22+), but the import shape changed:
  ```js
  // before
  const ncu = require('npm-check-updates')
  // after
  const { default: ncu } = require('npm-check-updates')
  ncu({ /* ... */ }).then(upgraded => console.log(upgraded))
  ```

**3. `filterVersion` / `rejectVersion` no longer accept a predicate function. Use `filter` / `reject` instead.** (#1933)
These options now accept only a string, wildcard, glob, comma/space-delimited list, or `/regex/`. (CLI usage is unchanged — the CLI never supported functions.)
- *Migration:* If you passed a function to `filterVersion`/`rejectVersion` in `.ncurc.js` or via the module API, move it to `filter` / `reject` instead. Those receive the package name **and** the parsed current version, so they can match on both:
  ```js
  // before
  filterVersion: (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
  // after
  filter:        (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
  ```

**4. Output is now grouped by default** (#1937)
`--format` now defaults to `["group"]`, so upgrades are grouped by major / minor / patch out of the box. This is a better default for most users.
- *Migration:* To get the old flat output, use:
  ```bash
  ncu --format no-group
  ```
  The new `no-` prefix removes a value from the default list instead of replacing the whole list, so `--format no-group,time` disables grouping while adding publish times.

**5. `--target semver` now respects explicit upper bounds** (#1920)
An explicit upper bound in a range is now preserved and never exceeded, e.g. `^9.5.0 <10` → `^9.7.0 <10` (previously the bound could be overrun). This can change which versions are selected for ranges with explicit upper bounds.

###### ✨ Other improvements
- Native TypeScript loading (#1888), lazy-loaded `npm-registry-fetch` for faster startup (#1898), and reduced dependencies for a lighter install.
- Numerous bug fixes: scoped-package 404s with encoded `@` (#1923), `--doctor` + `--errorLevel 2` crash (#1900), registry settings ignored by `--enginesNode`/`--ownerChanged` (#1925), and YAML catalog preservation (#1922), abort packument stream once required fields are parsed (#1901) for better performance, fix cli options being overridden by .ncurc in --deep mode (#1902), and upgrade a package in all selected sections when versions differ.

**Full changelog:** https://github.com/raineorshine/npm-check-updates/compare/v22.2.9...v23.0.0

### v22.2.9

- Date: 2026-06-28
- Version: v22.2.9
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v22.2.9
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v22.2.9

##### What's Changed
* Dockerfile: use lts-alpine image by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1862
* Rename variable and test file by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1884
* eslint.config.js: drop moot jest globals by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1887
* replace zod with valibot to reduce bundle size by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1885
* CI: add prettier in lint workflow by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1889
* Use async glob instead of glob.sync in getAllPackages by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1891
* Minor type tweaks by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1892
* Switch mocha tests to parallel by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1886
* Replace markdownlint-cli with markdownlint-cli2 by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1893


**Full Changelog**: https://github.com/raineorshine/npm-check-updates/compare/v22.2.8...v22.2.9

### v22.2.8

- Date: 2026-06-27
- Version: v22.2.8
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v22.2.8
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v22.2.8

##### What's Changed
* CI: remove concurrency by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1846
* build(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1872
* Downgrade ts-json-schema-generator to v2.4.0 for Node.js 20 support by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1848
* prepare: add exit 0 as an extra guard by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1850
* ESLint: bump to es2023 globals by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1854
* package.json: remove redundant tests from files by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1855
* tsconfig: enable verbatimModuleSyntax by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1860
* Remove the unused libnpmconfig.d.ts by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1857
* Clean up `run()` return type JSDoc by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1868
* cache test: remove any previous stale cache file to prevent failures by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1865
* package.json: remove duplicate typecheck script by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1856
* Doctor tests cleanup by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1869
* fix: skip cache write when cooldown is active by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1871
* Fix stale @param names in JSDoc by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1874
* Simplify tsconfig.json by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1858
* Add a .npmrc file enabling engine-strict by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1847
* Enforce node: protocol and dedupe imports by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1842
* Fix verbose log printing local yarn config under "user yarn config" header by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1875
* lint: add --continue-on-error by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1859
* test: cover `$` override references by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1877
* CI updates by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1870
* More shell tweaks by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1853
* Update interactive hint for q button by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1879
* Vite config cleanup by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1861
* package.json: remove unneeded overrides by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1849
* build: stub unused iconv-lite out of the bundle by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1881
* package.json: specify allowScripts by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1878
* build(deps): bump softprops/action-gh-release by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1880
* refactor prettifyCooldown and share the cooldown regex by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1883
* build(deps-dev): bump the development-dependencies group across 1 directory with 5 updates by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1876
* fix(cooldown): scope auto-cooldown config to active package manager only by @raineorshine with @Copilot in https://github.com/raineorshine/npm-check-updates/pull/1882


**Full Changelog**: https://github.com/raineorshine/npm-check-updates/compare/v22.2.7...v22.2.8

### v22.2.7

- Date: 2026-06-20
- Version: v22.2.7
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v22.2.7
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v22.2.7

##### What's Changed
* Fix CodeQL issues by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1813
* Escape package name and reuse escapeRegExp by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1838
* Remove redundant awaits and enable @typescript-eslint/await-thenable by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1839
* Stop exporting the externally unused getOwnerPerDependency by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1840
* Perf improvements by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1843
* Move configs out of package.json by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1841
* build(deps): downgrade ini from 7.0.0 to 6.0.0 to restore Node 20 support by @raineorshine in https://github.com/raineorshine/npm-check-updates/pull/1845


**Full Changelog**: https://github.com/raineorshine/npm-check-updates/compare/v22.2.6...v22.2.7

### v22.2.6

- Date: 2026-06-20
- Version: v22.2.6
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v22.2.6
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v22.2.6

##### What's Changed
* build(deps-dev): bump @typescript-eslint/eslint-plugin by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1787
* build(deps-dev): bump @typescript-eslint/parser from 8.60.1 to 8.61.0 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1788
* build(deps-dev): bump @microsoft/api-extractor from 7.58.7 to 7.58.8 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1789
* build(deps-dev): bump eslint-plugin-n from 18.0.1 to 18.1.0 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1790
* build(deps-dev): bump prettier from 3.8.3 to 3.8.4 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1792
* build(deps-dev): bump semver from 7.8.2 to 7.8.3 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1793
* build(deps-dev): bump cosmiconfig from 9.0.1 to 9.0.2 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1791
* build(deps-dev): bump shell-quote from 1.8.3 to 1.8.4 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1795
* Dependabot: add github-actions updates and group updates with a cooldown by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1785
* CI: harden and align GitHub Actions workflows by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1786
* feat: respect min-release-age-exclude with min-release-age npm config by @Cherry in https://github.com/raineorshine/npm-check-updates/pull/1797
* feat: add Claude Code SKILL file for npm-check-updates by @ilteoood in https://github.com/raineorshine/npm-check-updates/pull/1798
* build(deps): bump esbuild from 0.28.0 to 0.28.1 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1799
* Quote global package specs with a period in the scope for PowerShell compatibility by @raineorshine with @Copilot in https://github.com/raineorshine/npm-check-updates/pull/1800
* Add a GitHub workflow to clean up closed PRs' caches by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1804
* package.json: fix npm scripts to be cross-platform by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1805
* Replace the unmaintained npm-run-all with npm-run-all2 and removed unused deps by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1806
* build workflow: add npm pack --dry-run by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1807
* test/e2e.sh: fix shellcheck issues by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1808
* Replace rfdc with native structuredClone by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1809
* Replace js-yaml with yaml by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1810
* Replace dequal with node:util isDeepStrictEqual by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1811
* fix: do not call semver.minVersion on non-semver package protocols by @duniul in https://github.com/raineorshine/npm-check-updates/pull/1767
* Convert inline code backticks to `<code>` in generated HTML tables by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1814
* Fix skills by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1815
* Vite: use 'oxc' for minify by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1816
* build(deps): bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1817
* build-options.ts: split README and schema writes, drop duplicate RunOptions.json write by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1818
* Remove lodash-es by @XhmikosR in https://github.com/raineorshine/npm-check-updates/pull/1819
* Replace cosmiconfig with lilconfig by @XhmikosR in https://github.co

_[Truncated at 4000 characters — full notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v22.2.6]_

### v22.2.5

- Date: 2026-06-06
- Version: v22.2.5
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v22.2.5
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v22.2.5

e951cf45 Bump minor and patch.
0f9f53d8 prettier
edf42129 Make deep tests path-agnostic with regex patterns
b8201313 Only show missing time when time or cooldown format is requested

**Full Changelog**: https://github.com/raineorshine/npm-check-updates/compare/v22.2.3...v22.2.5

### v22.2.4

- Date: 2026-06-06
- Version: v22.2.4
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v22.2.4
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v22.2.4

*[ignore]*

### v22.2.3

- Date: 2026-06-06
- Version: v22.2.3
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v22.2.3
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v22.2.3

##### What's Changed
* build(deps-dev): bump semver from 7.8.0 to 7.8.1 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1760
* build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1781
* build(deps-dev): bump unplugin-dts from 1.0.1 to 1.0.2 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1780
* build(deps-dev): bump eslint-import-resolver-typescript by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1779
* build(deps-dev): bump tsx from 4.22.3 to 4.22.4 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1778
* fix: handle registries missing 'time' metadata during version resolution by @onemen in https://github.com/raineorshine/npm-check-updates/pull/1763
* Fall back to pnpm global config for minimumReleaseAge cooldown by @Copilot in https://github.com/raineorshine/npm-check-updates/pull/1777


**Full Changelog**: https://github.com/raineorshine/npm-check-updates/compare/v22.2.2...v22.2.3

### v22.2.2

- Date: 2026-06-03
- Version: v22.2.2
- Original notes: https://github.com/raineorshine/npm-check-updates/releases/tag/v22.2.2
- Permalink: https://whatsnew.fyi/product/npm-check-updates/releases/v22.2.2

##### What's Changed
* test: use node util to strip ansi in deep test by @terminalchai in https://github.com/raineorshine/npm-check-updates/pull/1769
* build(deps-dev): bump vite from 8.0.13 to 8.0.16 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1774
* Switch from vite-plugin-dts to unplugin-dts by @Copilot in https://github.com/raineorshine/npm-check-updates/pull/1749
* test: remove unused temp directory creation by @terminalchai in https://github.com/raineorshine/npm-check-updates/pull/1770
* test: cover Windows spawn command fallback by @terminalchai in https://github.com/raineorshine/npm-check-updates/pull/1771
* build(deps-dev): bump sinon from 21.1.2 to 22.0.0 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1751
* fix: parse Yarn duration string format for npmMinimalAgeGate by @Copilot in https://github.com/raineorshine/npm-check-updates/pull/1768
* build(deps-dev): bump @types/bun from 1.3.13 to 1.3.14 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1754
* build(deps-dev): bump @typescript-eslint/parser from 8.59.4 to 8.60.1 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1773
* build(deps-dev): bump mocha from 11.7.5 to 11.7.6 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1753
* build(deps-dev): bump verdaccio from 6.6.0 to 6.7.2 by @dependabot[bot] in https://github.com/raineorshine/npm-check-updates/pull/1759


**Full Changelog**: https://github.com/raineorshine/npm-check-updates/compare/v22.2.1...v22.2.2