⚠️ Breaking changes & migration

1. Node.js 22+ required (#1844)
The minimum supported Node.js is now 22. Supported versions: ^22.22.2 || ^24.15.0 || >=26.0.0 (and npm >=10).

• Migration: Upgrade Node before installing. On older Node, stay on v22.x.

2. Pure ESM package — CJS build dropped, default export is now callable (#1916, #1894)
The package is now pure ESM (no more CommonJS build), and the default export is now callable directly. ncu.run() and ncu.defineConfig() still work as namespaced properties.

• Migration (ESM):

  // before
  import * as ncu from 'npm-check-updates'
  const upgraded = await ncu.run({ /* ... */ })
  // after
  import ncu from 'npm-check-updates'
  const upgraded = await ncu({ /* ... */ }) // ncu.run({...}) also still works

• Migration (CommonJS): Still usable via Node's native require() of ESM (Node 22+), but the import shape changed:

  // before
  const ncu = require('npm-check-updates')
  // after
  const { default: ncu } = require('npm-check-updates')
  ncu({ /* ... */ }).then(upgraded => console.log(upgraded))

3. filterVersion / rejectVersion no longer accept a predicate function. Use filter / reject instead. (#1933)
These options now accept only a string, wildcard, glob, comma/space-delimited list, or /regex/. (CLI usage is unchanged — the CLI never supported functions.)

• Migration: If you passed a function to filterVersion/rejectVersion in .ncurc.js or via the module API, move it to filter / reject instead. Those receive the package name and the parsed current version, so they can match on both:

  // before
  filterVersion: (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)
  // after
  filter:        (name, semver) => !(name.startsWith('@myorg/') && +semver[0].major > 5)

4. Output is now grouped by default (#1937)
--format now defaults to ["group"], so upgrades are grouped by major / minor / patch out of the box. This is a better default for most users.

• Migration: To get the old flat output, use:

  ncu --format no-group

  The new no- prefix removes a value from the default list instead of replacing the whole list, so --format no-group,time disables grouping while adding publish times.

5. --target semver now respects explicit upper bounds (#1920)
An explicit upper bound in a range is now preserved and never exceeded, e.g. ^9.5.0 <10 → ^9.7.0 <10 (previously the bound could be overrun). This can change which versions are selected for ranges with explicit upper bounds.

✨ Other improvements

• Native TypeScript loading (#1888), lazy-loaded npm-registry-fetch for faster startup (#1898), and reduced dependencies for a lighter install.
• Numerous bug fixes: scoped-package 404s with encoded @ (#1923), --doctor + --errorLevel 2 crash (#1900), registry settings ignored by --enginesNode/--ownerChanged (#1925), and YAML catalog preservation (#1922), abort packument stream once required fields are parsed (#1901) for better performance, fix cli options being overridden by .ncurc in --deep mode (#1902), and upgrade a package in all selected sections when versions differ.

Full changelog: v22.2.9...v23.0.0

What's Changed

• Dockerfile: use lts-alpine image by @XhmikosR in #1862
• Rename variable and test file by @XhmikosR in #1884
• eslint.config.js: drop moot jest globals by @XhmikosR in #1887
• replace zod with valibot to reduce bundle size by @XhmikosR in #1885
• CI: add prettier in lint workflow by @XhmikosR in #1889
• Use async glob instead of glob.sync in getAllPackages by @XhmikosR in #1891
• Minor type tweaks by @XhmikosR in #1892
• Switch mocha tests to parallel by @XhmikosR in #1886
• Replace markdownlint-cli with markdownlint-cli2 by @XhmikosR in #1893

Full Changelog: v22.2.8...v22.2.9

What's Changed

• CI: remove concurrency by @XhmikosR in #1846
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the github-actions group by @dependabot[bot] in #1872
• Downgrade ts-json-schema-generator to v2.4.0 for Node.js 20 support by @XhmikosR in #1848
• prepare: add exit 0 as an extra guard by @XhmikosR in #1850
• ESLint: bump to es2023 globals by @XhmikosR in #1854
• package.json: remove redundant tests from files by @XhmikosR in #1855
• tsconfig: enable verbatimModuleSyntax by @XhmikosR in #1860
• Remove the unused libnpmconfig.d.ts by @XhmikosR in #1857
• Clean up run() return type JSDoc by @XhmikosR in #1868
• cache test: remove any previous stale cache file to prevent failures by @XhmikosR in #1865
• package.json: remove duplicate typecheck script by @XhmikosR in #1856
• Doctor tests cleanup by @XhmikosR in #1869
• fix: skip cache write when cooldown is active by @XhmikosR in #1871
• Fix stale @param names in JSDoc by @XhmikosR in #1874
• Simplify tsconfig.json by @XhmikosR in #1858
• Add a .npmrc file enabling engine-strict by @XhmikosR in #1847
• Enforce node: protocol and dedupe imports by @XhmikosR in #1842
• Fix verbose log printing local yarn config under "user yarn config" header by @XhmikosR in #1875
• lint: add --continue-on-error by @XhmikosR in #1859
• test: cover $ override references by @XhmikosR in #1877
• CI updates by @XhmikosR in #1870
• More shell tweaks by @XhmikosR in #1853
• Update interactive hint for q button by @XhmikosR in #1879
• Vite config cleanup by @XhmikosR in #1861
• package.json: remove unneeded overrides by @XhmikosR in #1849
• build: stub unused iconv-lite out of the bundle by @XhmikosR in #1881
• package.json: specify allowScripts by @XhmikosR in #1878
• build(deps): bump softprops/action-gh-release by @dependabot[bot] in #1880
• refactor prettifyCooldown and share the cooldown regex by @XhmikosR in #1883
• build(deps-dev): bump the development-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #1876
• fix(cooldown): scope auto-cooldown config to active package manager only by @raineorshine with @Copilot in #1882

Full Changelog: v22.2.7...v22.2.8

What's Changed

• Fix CodeQL issues by @XhmikosR in #1813
• Escape package name and reuse escapeRegExp by @XhmikosR in #1838
• Remove redundant awaits and enable @typescript-eslint/await-thenable by @XhmikosR in #1839
• Stop exporting the externally unused getOwnerPerDependency by @XhmikosR in #1840
• Perf improvements by @XhmikosR in #1843
• Move configs out of package.json by @XhmikosR in #1841
• build(deps): downgrade ini from 7.0.0 to 6.0.0 to restore Node 20 support by @raineorshine in #1845

Full Changelog: v22.2.6...v22.2.7

What's Changed

• build(deps-dev): bump @typescript-eslint/eslint-plugin by @dependabot[bot] in #1787
• build(deps-dev): bump @typescript-eslint/parser from 8.60.1 to 8.61.0 by @dependabot[bot] in #1788
• build(deps-dev): bump @microsoft/api-extractor from 7.58.7 to 7.58.8 by @dependabot[bot] in #1789
• build(deps-dev): bump eslint-plugin-n from 18.0.1 to 18.1.0 by @dependabot[bot] in #1790
• build(deps-dev): bump prettier from 3.8.3 to 3.8.4 by @dependabot[bot] in #1792
• build(deps-dev): bump semver from 7.8.2 to 7.8.3 by @dependabot[bot] in #1793
• build(deps-dev): bump cosmiconfig from 9.0.1 to 9.0.2 by @dependabot[bot] in #1791
• build(deps-dev): bump shell-quote from 1.8.3 to 1.8.4 by @dependabot[bot] in #1795
• Dependabot: add github-actions updates and group updates with a cooldown by @XhmikosR in #1785
• CI: harden and align GitHub Actions workflows by @XhmikosR in #1786
• feat: respect min-release-age-exclude with min-release-age npm config by @Cherry in #1797
• feat: add Claude Code SKILL file for npm-check-updates by @ilteoood in #1798
• build(deps): bump esbuild from 0.28.0 to 0.28.1 by @dependabot[bot] in #1799
• Quote global package specs with a period in the scope for PowerShell compatibility by @raineorshine with @Copilot in #1800
• Add a GitHub workflow to clean up closed PRs' caches by @XhmikosR in #1804
• package.json: fix npm scripts to be cross-platform by @XhmikosR in #1805
• Replace the unmaintained npm-run-all with npm-run-all2 and removed unused deps by @XhmikosR in #1806
• build workflow: add npm pack --dry-run by @XhmikosR in #1807
• test/e2e.sh: fix shellcheck issues by @XhmikosR in #1808
• Replace rfdc with native structuredClone by @XhmikosR in #1809
• Replace js-yaml with yaml by @XhmikosR in #1810
• Replace dequal with node:util isDeepStrictEqual by @XhmikosR in #1811
• fix: do not call semver.minVersion on non-semver package protocols by @duniul in #1767
• Convert inline code backticks to <code> in generated HTML tables by @XhmikosR in #1814
• Fix skills by @XhmikosR in #1815
• Vite: use 'oxc' for minify by @XhmikosR in #1816
• build(deps): bump form-data from 4.0.5 to 4.0.6 by @dependabot[bot] in #1817
• build-options.ts: split README and schema writes, drop duplicate RunOptions.json write by @XhmikosR in #1818
• Remove lodash-es by @XhmikosR in #1819
• Replace cosmiconfig with lilconfig by @XhmikosR in #1812
• Remove redundant Promise.resolve in fetchUpgradedPackument by @XhmikosR in #1823
• Switch to async/await in a few more places by @XhmikosR in #1824
• Replace forEach with for...of by @XhmikosR in #1825
• Yarn test fixes by @XhmikosR in #1828
• fix padLeft adding trailing spaces to blank lines by @XhmikosR in #1829
• Remove unused dev dependencies by @XhmikosR in #1820
• fix: replace async reduce with for-of loop in --deep to avoid OOM by @XhmikosR in #1831
• test.yml: remove redundant permissions block by @XhmikosR in #1832
• fix MaxListenersExceededWarning when calling run() repeatedly by @XhmikosR in #1833
• fix: resolve workspace paths relative to --packageFile dir, not cwd by @XhmikosR in #1834
• fix: inline semver-utils types in the d.ts rollup by @XhmikosR in #1835
• Drop rimraf in favor of Vite emptyOutDir by @XhmikosR in #1821
• CI: add Node.js 26 by @XhmikosR in #1836
• CI tweaks by @XhmikosR in #1837
• Move src/scripts to the root folder by @XhmikosR in #1827

New Contributors

• @ilteoood made their first contribution in #1798
• @duniul made their first contribution in #1767

Full Changelog: v22.2.5...v22.2.6

e951cf4 Bump minor and patch.
0f9f53d prettier
edf4212 Make deep tests path-agnostic with regex patterns
b820131 Only show missing time when time or cooldown format is requested

Full Changelog: v22.2.3...v22.2.5

[ignore]

What's Changed

• build(deps-dev): bump semver from 7.8.0 to 7.8.1 by @dependabot[bot] in #1760
• build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in #1781
• build(deps-dev): bump unplugin-dts from 1.0.1 to 1.0.2 by @dependabot[bot] in #1780
• build(deps-dev): bump eslint-import-resolver-typescript by @dependabot[bot] in #1779
• build(deps-dev): bump tsx from 4.22.3 to 4.22.4 by @dependabot[bot] in #1778
• fix: handle registries missing 'time' metadata during version resolution by @onemen in #1763
• Fall back to pnpm global config for minimumReleaseAge cooldown by @Copilot in #1777

Full Changelog: v22.2.2...v22.2.3

What's Changed

• test: use node util to strip ansi in deep test by @terminalchai in #1769
• build(deps-dev): bump vite from 8.0.13 to 8.0.16 by @dependabot[bot] in #1774
• Switch from vite-plugin-dts to unplugin-dts by @Copilot in #1749
• test: remove unused temp directory creation by @terminalchai in #1770
• test: cover Windows spawn command fallback by @terminalchai in #1771
• build(deps-dev): bump sinon from 21.1.2 to 22.0.0 by @dependabot[bot] in #1751
• fix: parse Yarn duration string format for npmMinimalAgeGate by @Copilot in #1768
• build(deps-dev): bump @types/bun from 1.3.13 to 1.3.14 by @dependabot[bot] in #1754
• build(deps-dev): bump @typescript-eslint/parser from 8.59.4 to 8.60.1 by @dependabot[bot] in #1773
• build(deps-dev): bump mocha from 11.7.5 to 11.7.6 by @dependabot[bot] in #1753
• build(deps-dev): bump verdaccio from 6.6.0 to 6.7.2 by @dependabot[bot] in #1759

Full Changelog: v22.2.1...v22.2.2

What's Changed

• build(deps-dev): bump @typescript-eslint/eslint-plugin by @dependabot[bot] in #1727
• build(deps-dev): bump verdaccio from 6.5.2 to 6.6.0 by @dependabot[bot] in #1728
• build(deps-dev): bump yaml from 2.8.4 to 2.9.0 by @dependabot[bot] in #1729
• fix: normalize blank-line spacing between packages in --deep mode by @terminalchai in #1738
• Fix TypeError when running ncu from a subdirectory without a package.json by @Copilot in #1737
• build(deps-dev): bump semver from 7.7.4 to 7.8.0 by @dependabot[bot] in #1731
• build(deps-dev): bump ini from 6.0.0 to 7.0.0 by @dependabot[bot] in #1726
• build(deps-dev): bump @typescript-eslint/eslint-plugin from 8.59.3 to 8.59.4 by @dependabot[bot] in #1739
• build(deps-dev): bump vite from 8.0.9 to 8.0.13 by @dependabot[bot] in #1740
• build(deps-dev): bump tsx from 4.21.0 to 4.22.3 by @dependabot[bot] in #1741
• build(deps-dev): bump @typescript-eslint/parser from 8.59.3 to 8.59.4 by @dependabot[bot] in #1743
• build(deps-dev): bump @types/node from 25.6.0 to 25.9.1 by @dependabot[bot] in #1744
• build(deps-dev): bump vite-plugin-dts from 4.5.4 to 5.0.0 by @dependabot[bot] in #1713
• build(deps-dev): bump @eslint/compat from 2.0.5 to 2.1.0 by @dependabot[bot] in #1732

Full Changelog: v22.2.0...v22.2.1