Strategies for Dependency Maintenance and Upgrades
npm-check, npm-check-updates, and yarn-upgrade-all are utilities designed to help developers manage outdated dependencies, but they serve different stages of the maintenance workflow. npm-check is an interactive tool that audits your project, highlighting unused, missing, and outdated packages while allowing you to selectively upgrade them via a CLI interface. npm-check-updates (ncu) is a non-interactive automation tool focused on updating version specifications in package.json to the latest available versions without touching node_modules. yarn-upgrade-all is a legacy utility specifically for Yarn users that attempts to upgrade every dependency to its latest version in a single command, often bypassing strict version locks. While all three address dependency drift, their approaches range from careful auditing to blunt-force updating.
Npm Package Weekly Downloads Trend
Github Stars Ranking
Stat Detail
Dependency Management Tools: npm-check vs npm-check-updates vs yarn-upgrade-all
Keeping dependencies up to date is one of the most tedious but critical tasks in frontend architecture. Outdated packages introduce security vulnerabilities, miss performance improvements, and eventually lead to "dependency hell" where upgrading becomes impossible. The ecosystem offers several tools to solve this, but they take fundamentally different approaches. npm-check, npm-check-updates, and yarn-upgrade-all represent three distinct philosophies: interactive auditing, manifest automation, and blanket upgrading.
🔍 Interaction Model: Interactive UI vs CLI Automation vs Blind Execution
The most immediate difference is how you interact with these tools. npm-check provides an interactive terminal interface that pauses execution to let you make decisions. npm-check-updates runs as a standard command-line utility that outputs results or modifies files directly. yarn-upgrade-all executes immediately without confirmation, applying changes globally.
npm-check launches a visual menu in your terminal. It scans your project and presents a list of outdated, unused, or missing packages. You navigate with arrow keys and toggle selections with the spacebar.
# npm-check: Interactive selection
npx npm-check
# Output: A scrollable list where you select packages to update
# [x] lodash 4.17.20 ❯ 4.17.21
# [ ] react 17.0.1 ❯ 18.2.0
npm-check-updates runs silently or with verbose logging, modifying your package.json file directly without asking for confirmation during the scan. It separates the "checking" phase from the "installing" phase.
# npm-check-updates: Update package.json only
npx npm-check-updates -u
# Output: Updates version numbers in package.json
# All dependencies updated to latest versions.
yarn-upgrade-all attempts to upgrade everything in one go. It does not offer a selection menu or a dry-run mode by default in its standard usage, making it a "run and hope" tool.
# yarn-upgrade-all: Blind global upgrade
npx yarn-upgrade-all
# Output: Immediately fetches and installs latest versions for all deps
📝 Manifest Modification: Selective vs Global vs Forceful
How these tools modify your package.json determines how safe they are for production workflows. npm-check allows selective updates. npm-check-updates allows targeted updates based on rules. yarn-upgrade-all ignores most rules to force an upgrade.
npm-check updates only the packages you explicitly select in the interactive menu. It respects your current version constraints unless you choose to bump them.
// npm-check: Only selected packages are updated in package.json
// Before: "lodash": "^4.17.20"
// After (if selected): "lodash": "^4.17.21"
// Unselected packages remain untouched.
npm-check-updates gives you flags to control exactly which dependencies get updated. You can choose to update only patches, minors, or majors, and you can separate production from development dependencies.
# npm-check-updates: Granular control
npx npm-check-updates -t minor --dep prod
# Updates only production dependencies to the latest minor version
# Leaves major versions and devDependencies untouched.
yarn-upgrade-all effectively removes version constraints by forcing every package to the latest available version, regardless of major version bumps. This often breaks semantic versioning guarantees.
// yarn-upgrade-all: Forces latest versions everywhere
// Before: "react": "^17.0.1"
// After: "react": "^18.2.0" (Even if this is a breaking major change)
// Risk: High probability of breaking changes introduced silently.
🧹 Project Hygiene: Detecting Unused vs Just Updating
A unique feature of npm-check is its ability to detect dependencies that are installed but not used in your code, or dependencies that are used but missing from package.json. The other two tools focus solely on version numbers.
npm-check analyzes your source code (if configured) to find dead weight. It marks unused packages with a specific indicator, allowing you to remove them and reduce bundle size.
# npm-check: Identifies unused packages
# Output legend:
# ✖ unused (Package is in package.json but not imported)
# ✖ missing (Package is imported but not in package.json)
# ● outdated (Package has a newer version)
npm-check-updates assumes every dependency in your package.json is needed. It does not scan your source code for usage. Its sole purpose is version alignment.
# npm-check-updates: No usage analysis
# It will update a package even if you never import it in your code.
# Focus: Strictly version management.
yarn-upgrade-all also lacks hygiene features. It treats all dependencies as essential and upgrades them blindly. It offers no insight into whether a package is actually contributing to your build.
# yarn-upgrade-all: No hygiene checks
# Upgrades unused and used packages alike.
# Focus: Maximum version freshness regardless of utility.
🛡️ Safety and Workflow Integration
In a professional CI/CD pipeline or team environment, predictability is key. npm-check-updates is the safest for automation because it separates the manifest update from the installation. npm-check is best for local developer maintenance. yarn-upgrade-all is generally unsafe for automated workflows.
npm-check requires a human in the loop. You cannot easily run it in a non-interactive CI environment without extra flags that disable its core value proposition (the UI). It is best run locally by developers before committing code.
# npm-check: Best for local interactive cleanup
npx npm-check -u
# Developer reviews the list, deselects risky major updates, and confirms.
npm-check-updates is designed for scripts. You can run it to update package.json, commit the change, and then let your package manager (npm install or yarn install) handle the actual resolution and locking in a controlled manner.
# npm-check-updates: CI/CD friendly pattern
npx npm-check-updates -u --target minor
npm install
# The lockfile is regenerated based on the new manifest constraints.
yarn-upgrade-all bypasses the lockfile regeneration process in a controlled way and often leads to inconsistent states across different developer machines if the lockfile is not carefully managed afterwards. It is widely recommended to avoid this in favor of native Yarn commands.
# Modern Alternative to yarn-upgrade-all
yarn upgrade-interactive --latest
# Provides a safe, interactive UI similar to npm-check but native to Yarn.
🌱 Real-World Scenarios
Scenario 1: Quarterly Dependency Audit
You need to clean up the project, remove unused libraries, and safely update others.
- ✅ Best choice:
npm-check - Why? It identifies unused packages for removal and lets you visually verify major version updates before applying them.
# Run interactive audit
npx npm-check
# Deselect major updates that require code changes, select unused packages to uninstall.
Scenario 2: Automated Security Patching Pipeline
Your CI bot needs to open PRs for minor and patch updates automatically.
- ✅ Best choice:
npm-check-updates - Why? It can be scripted to update
package.jsonwithout human interaction, limiting scope to non-breaking changes.
# Scripted update for CI
npx npm-check-updates -u --target minor --dep prod,dev
git add package.json
# Commit and let tests run against the new versions.
Scenario 3: Legacy Yarn Project Cleanup
You are stuck on an old Yarn version and need to force-refresh everything (not recommended for modern stacks).
- ⚠️ Legacy choice:
yarn-upgrade-all - Why? Only use if you have no other option and understand the high risk of breaking changes. Modern teams should use
yarn upgrade-interactiveinstead.
# Modern preferred approach over yarn-upgrade-all
yarn upgrade-interactive --latest
# Select specific packages to upgrade safely within the Yarn ecosystem.
📌 Summary Table
| Feature | npm-check | npm-check-updates | yarn-upgrade-all |
|---|---|---|---|
| Interface | 🖥️ Interactive CLI Menu | 💻 Command Line Arguments | 💣 Immediate Execution |
| Primary Goal | 🧹 Audit & Selective Update | 🔄 Manifest Automation | 🚀 Force Global Upgrade |
| Unused Deps | ✅ Detects and removes | ❌ Ignores | ❌ Ignores |
| Safety | 🛡️ High (Manual Review) | 🛡️ High (Configurable) | ⚠️ Low (Blind Updates) |
| CI/CD Ready | ❌ No (Interactive) | ✅ Yes | ❌ No (Unpredictable) |
| Ecosystem | npm / yarn | npm / yarn | Yarn Only (Legacy) |
💡 Final Recommendation
For modern frontend architecture, npm-check-updates is the industry standard for automating version bumps in package.json. It strikes the right balance between power and safety, especially when combined with a robust test suite and lockfile management.
Use npm-check periodically (e.g., once a sprint) as a hygiene tool to remove dead weight and manually review major updates. Its ability to spot unused dependencies is unmatched by the others.
Avoid yarn-upgrade-all in new projects. It represents an older, riskier approach to dependency management. If you use Yarn, rely on the built-in yarn upgrade-interactive command, which provides the safety of selection with the power of the Yarn resolver.
Final Thought: Dependency management is not just about getting the latest numbers; it's about maintaining a stable, clean, and secure codebase. Choose the tool that gives you visibility and control, not just speed.
How to Choose: npm-check vs npm-check-updates vs yarn-upgrade-all
- npm-check:
Choose
npm-checkwhen you need an interactive audit of your project health, not just version updates. It is ideal for cleaning uppackage.jsonby identifying unused dependencies or detecting missing peers before upgrading. Use this when you want a safety net that lets you visually select which packages to update and which to ignore on a case-by-case basis. - npm-check-updates:
Choose
npm-check-updateswhen you want to automate the process of updating version ranges inpackage.jsonwithout immediately installing them. It is the standard choice for CI/CD pipelines or bulk updates where you need to modify the manifest file to point to newer versions (major, minor, or patch) before running a fresh install. It offers fine-grained control over which dependency types (dev, prod, peer) to update. - yarn-upgrade-all:
Avoid choosing
yarn-upgrade-allfor new projects or critical production environments. This package is largely considered legacy and risky because it forces a global upgrade of all dependencies, often ignoring semantic versioning safety nets and potentially breaking builds. Modern Yarn versions include built-in commands likeyarn upgrade-interactivethat provide safer, more controlled alternatives for achieving similar results.
Popular Comparisons
README for npm-check
npm-check
Check for outdated, incorrect, and unused dependencies.
Features
- Tells you what's out of date.
- Provides a link to the package's documentation so you can decide if you want the update.
- Kindly informs you if a dependency is not being used in your code.
- Works on your globally installed packages too, via
-g. - Interactive Update for less typing and fewer typos, via
-u. - Supports public and private @scoped/packages.
- Supports ES6-style
import fromsyntax. - Upgrades your modules using your installed version of npm, including the new
npm@3, so dependencies go where you expect them. - Works with any public npm registry, private registries, and alternate registries like Sinopia.
- Does not query registries for packages with
private: truein their package.json. - Emoji in a command-line app, because command-line apps can be fun too.
- Works with
npm@2andnpm@3, as well as newer alternative installers likeiedandpnpm.
Requirements
- Node >= 10.9.0
On the command line
This is the easiest way to use npm-check.
Install
$ npm install -g npm-check
Use
$ npm-check
The result should look like the screenshot, or something nice when your packages are all up-to-date and in use.
When updates are required it will return a non-zero response code that you can use in your CI tools.
Options
Usage
$ npm-check <path> <options>
Path
Where to check. Defaults to current directory. Use -g for checking global modules.
Options
-u, --update Interactive update.
-y, --update-all Uninteractive update. Apply all updates without prompting.
-g, --global Look at global modules.
-s, --skip-unused Skip check for unused packages.
-p, --production Skip devDependencies.
-d, --dev-only Look at devDependencies only (skip dependencies).
-i, --ignore Ignore dependencies based on succeeding glob.
-E, --save-exact Save exact version (x.y.z) instead of caret (^x.y.z) in package.json.
--specials List of depcheck specials to include in check for unused dependencies.
--no-color Force or disable color output.
--no-emoji Remove emoji support. No emoji in default in CI environments.
--debug Show debug output. Throw in a gist when creating issues on github.
Examples
$ npm-check # See what can be updated, what isn't being used.
$ npm-check ../foo # Check another path.
$ npm-check -gu # Update globally installed modules by picking which ones to upgrade.
-u, --update
Show an interactive UI for choosing which modules to update.
Automatically updates versions referenced in the package.json.
Based on recommendations from the npm team, npm-check only updates using npm install, not npm update.
To avoid using more than one version of npm in one directory, npm-check will automatically install updated modules
using the version of npm installed globally.
Update using ied or pnpm
Set environment variable NPM_CHECK_INSTALLER to the name of the installer you wish to use.
NPM_CHECK_INSTALLER=pnpm npm-check -u
## pnpm install --save-dev foo@version --color=always
You can also use this for dry-run testing:
NPM_CHECK_INSTALLER=echo npm-check -u
-y, --update-all
Updates your dependencies like --update, just without any prompt. This is especially useful if you want to automate your dependency updates with npm-check.
-g, --global
Check the versions of your globally installed packages.
If the value of process.env.NODE_PATH is set, it will override the default path of global node_modules returned by package global-modules.
Tip: Use npm-check -u -g to do a safe interactive update of global modules, including npm itself.
-s, --skip-unused
By default npm-check will let you know if any of your modules are not being used by looking at require statements
in your code.
This option will skip that check.
This is enabled by default when using global or update.
-p, --production
By default npm-check will look at packages listed as dependencies and devDependencies.
This option will let it ignore outdated and unused checks for packages listed as devDependencies.
-d, --dev-only
Ignore dependencies and only check devDependencies.
This option will let it ignore outdated and unused checks for packages listed as dependencies.
-i, --ignore
Ignore dependencies that match specified glob.
$ npm-check -i babel-* will ignore all dependencies starting with 'babel-'.
-E, --save-exact
Install packages using --save-exact, meaning exact versions will be saved in package.json.
Applies to both dependencies and devDependencies.
--specials
Check special (e.g. config) files when looking for unused dependencies.
$ npm-check --specials=bin,webpack will look in the scripts section of package.json and in webpack config.
See https://github.com/depcheck/depcheck#special for more information.
--color, --no-color
Enable or disable color support.
By default npm-check uses colors if they are available.
--emoji, --no-emoji
Enable or disable emoji support. Useful for terminals that don't support them. Automatically disabled in CI servers.
--spinner, --no-spinner
Enable or disable the spinner. Useful for terminals that don't support them. Automatically disabled in CI servers.
API
The API is here in case you want to wrap this with your CI toolset.
const npmCheck = require('npm-check');
npmCheck(options)
.then(currentState => console.log(currentState.get('packages')));
update
- Interactive update.
- default is
false
global
- Check global modules.
- default is
false cwdis automatically set with this option.
skipUnused
- Skip checking for unused packages.
- default is
false
ignoreDev
- Ignore
devDependencies. - This is called
--productionon the command line to matchnpm. - default is
false
devOnly
- Ignore
dependenciesand only checkdevDependencies. - default is
false
ignore
- Ignore dependencies that match specified glob.
- default is
[]
saveExact
- Update package.json with exact version
x.y.zinstead of semver range^x.y.z. - default is
false
debug
- Show debug output. Throw in a gist when creating issues on github.
- default is
false
cwd
- Override where
npm-checkchecks. - default is
process.cwd()
specials
- List of
depcheckspecial parsers to include. - default is
''
currentState
The result of the promise is a currentState object, look in state.js to see how it works.
You will probably want currentState.get('packages') to get an array of packages and the state of each of them.
Each item in the array will look like the following:
{
moduleName: 'lodash', // name of the module.
homepage: 'https://lodash.com/', // url to the home page.
regError: undefined, // error communicating with the registry
pkgError: undefined, // error reading the package.json
latest: '4.7.0', // latest according to the registry.
installed: '4.6.1', // version installed
isInstalled: true, // Is it installed?
notInstalled: false, // Is it installed?
packageWanted: '4.7.0', // Requested version from the package.json.
packageJson: '^4.6.1', // Version or range requested in the parent package.json.
devDependency: false, // Is this a devDependency?
usedInScripts: undefined, // Array of `scripts` in package.json that use this module.
mismatch: false, // Does the version installed not match the range in package.json?
semverValid: '4.6.1', // Is the installed version valid semver?
easyUpgrade: true, // Will running just `npm install` upgrade the module?
bump: 'minor', // What kind of bump is required to get the latest, such as patch, minor, major.
unused: false // Is this module used in the code?
},
You will also see this if you use --debug on the command line.
RC File Support
Additional options can be sent to the depcheck process. See depcheck API. Create a .npmcheckrc{.json,.yml,.js} file and set the depcheck options under depcheck property.
For example, to skip packages for unused check, but still want them in the outdated check (so can't use the --ignore option):
# .npmcheckrc
depcheck:
ignoreMatches: ["replace-in-file","snyk","sonarqube-scanner"]
Inspiration
- npm outdated - awkward output, requires --depth=0 to be grokable.
- david - does not work with private registries.
- update-notifier - for single modules, not everything in package.json.
- depcheck - only part of the puzzle. npm-check uses depcheck.
About the Author
Hi! Thanks for checking out this project! My name is Dylan Greene. When not overwhelmed with my two young kids I enjoy contributing
to the open source community. I'm also a tech lead at Opower. 
Here's some of my other Node projects:
| Name | Description | npm Downloads |
|---|---|---|
grunt‑notify | Automatic desktop notifications for Grunt errors and warnings. Supports OS X, Windows, Linux. |  |
shortid | Amazingly short non-sequential url-friendly unique id generator. |  |
space‑hogs | Discover surprisingly large directories from the command line. |  |
rss | RSS feed generator. Add RSS feeds to any project. Supports enclosures and GeoRSS. |  |
grunt‑prompt | Interactive prompt for your Grunt config using console checkboxes, text input with filtering, password fields. |  |
xml | Fast and simple xml generator. Supports attributes, CDATA, etc. Includes tests and examples. |  |
changelog | Command line tool (and Node module) that generates a changelog in color output, markdown, or json for modules in npmjs.org's registry as well as any public github.com repo. |  |
grunt‑attention | Display attention-grabbing messages in the terminal |  |
observatory | Beautiful UI for showing tasks running on the command line. |  |
anthology | Module information and stats for any @npmjs user |  |
grunt‑cat | Echo a file to the terminal. Works with text, figlets, ascii art, and full-color ansi. |  |
This list was generated using anthology.
License
Copyright (c) 2016 Dylan Greene, contributors.
Released under the MIT license.
Screenshots are CC BY-SA (Attribution-ShareAlike).