npm-check-updates
Upgrade package.json dependencies to the latest versions with npm-check-updates (ncu). Use when the user wants to check for outdated dependencies, upgrade package versions, filter or reject specific packages, target a specific version range (latest, greatest, minor, patch, semver, @tag), scan a single or multiple package files (--deep, --workspaces, --packageFile), run interactive selection (--interactive), detect breaking upgrades by running tests after each bump (--doctor), defend against supply-chain attacks with --cooldown, query private or alternate registries, or use the programmatic API from a .ncurc.js config or a Node module.
- Installs
- 438
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/ilteoood/harness --skill npm-check-updates- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads npm-check-updates automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
npm-check-updates (ncu)
npm-check-updates upgrades your package.json dependencies to the latest versions while preserving your existing version-range policy (^17.0.2 → ^18.3.1). It only modifies package.json; the user must run their package manager's install command (e.g. npm install) to update package-lock.json and node_modules.
The CLI is exposed as npm-check-updates and the shorter ncu. The library is pure ESM, importable from Node (and loadable from CommonJS via require()).
When to reach for this skill
- Listing outdated dependencies in a project.
- Bumping versions in
package.jsonto the newest available (dry run, interactive, or write to disk). - Bulk-upgrading with filters, rejections, peer-dependency awareness, or engine constraints.
- Scanning monorepos (workspaces,
--deep, custom globs). - Safer upgrades via cooldown windows or the iterative
--doctormode. - Driving ncu programmatically from a Node script or a
.ncurc.*config.
Quick start
# Dry run: print upgrades without touching files.
ncu
# Write the upgrades back into package.json, then install.
ncu -u
npm install
# Interactively pick which packages to upgrade.
ncu -i
# Only a subset of packages.
ncu -f "react,react-dom"
ncu "/^@types\//"
# Bump only patch / minor versions.
ncu --target patch
ncu --target minor
# Skip a package.
ncu -x typescript,eslint
Critical flags
| Flag | Purpose |
|---|---|
-u, --upgrade | Overwrite package.json (required for non-dry-run behaviour). |
-i, --interactive | Pick packages from a checklist. Implies -u unless a JSON output is set. |
-t, --target <value> | latest (default), newest, greatest, minor, patch, semver, or @<tag> (e.g. @next, @beta). |
-f, --filter <p> | Include only matching names. Accepts strings, wildcards, globs, comma or space lists, /regex/, or a predicate (in .ncurc.js). |
-x, --reject <p> | Exclude matching names. Same matcher syntax as --filter. Prefix ! works on positional args (ncu \!nodemon). |
-g, --global | Inspect globally installed packages instead of the local project. |
-p, --packageManager <s> | npm, yarn, pnpm, deno, bun, or staticRegistry. |
-d, --doctor | Iteratively install and test each upgrade to isolate breaking changes. Requires -u. |
-c, --cooldown <period> | Skip versions published within the window. 7 / 7d days, 12h hours, 30m minutes. Mitigates supply-chain risk. |
--peer | Respect peer-dependency constraints when picking a version. |
--enginesNode | Only consider versions compatible with the project's engines.node. |
--deep | Recurse into every package.json under the cwd. |
-w, --workspaces | Operate on every workspace (npm, yarn, pnpm). Pair with --no-root to exclude the root. |
--workspace <s> | Operate on the named workspace(s). Pair with --no-root to exclude the root. |
--packageFile <p> | Override the default package.json location. Accepts globs (packages/*/package.json). |
-j, --jsonAll | Output the new full package.json. |
--jsonDeps | Like --jsonAll but only the dependency fields. |
--jsonUpgraded | Output the upgraded dependencies as JSON. |
--format <value> | Comma list: dep, group, ownerChanged, repo, time, lines, installedVersion, cooldown. |
-l, --loglevel <n> | silent, error, minimal, warn (default), info, verbose, silly. |
-e, --errorLevel <n> | 1 (default) or 2. 2 is CI-friendly: exit 0 when nothing needs updating. |
--cache | Cache registry lookups. Default file: ~/.ncu-cache.json. Default TTL: 10 minutes. |
--cacheFile <path> | Cache file path. |
--cacheExpiration <min> | Cache TTL in minutes. |
--registry <uri> | Custom registry. |
--registryType <type> | npm (default) or json (a static JSON catalog). |
--install <value> | always, never, or prompt (default). Run install after -u? |
--pre <n> | Include prerelease versions. Auto-enabled for --target newest or greatest and when the current version is prerelease. |
--minimal | Skip upgrades whose range already satisfies the latest per semver. |
--removeRange | Strip the range operator and pin to the exact version. |
--timeout <ms> | Global timeout. Per-request default: 30 seconds. |
--retry <n> | Retries on failed registry requests (default: 3). |
--doctorInstall <cmd> | Override install command used by --doctor. |
--doctorTest <cmd> | Override test command used by --doctor. |
--mergeConfig | With --deep or a glob, merge each found config with the root config. |
--root | Include the root project alongside the specified workspaces. |
--stdin | Read package.json from stdin. |
--packageData <value> | Pass package.json content as a string. |
Config file (.ncurc.*)
ncu reads config from these locations (later overrides earlier): CLI flags → local .ncurc.* → project .ncurc.* → $HOME/.ncurc.*.
Supported file types: .ncurc, .ncurc.json, .ncurc.yaml, .ncurc.yml, .ncurc.js, .ncurc.mjs, .ncurc.cjs.
From v21 the project is pure ESM, so .ncurc.js should use ESM export default; CJS configs must use .cjs.
A .ncurc.js is also the only place to use predicate functions, e.g.:
export default {
filter: name => !name.startsWith('internal-'),
reject: ['@types/*'],
target: 'minor',
cooldown: 7,
doctor: false,
}
Programmatic API
import ncu from 'npm-check-updates'
const upgraded = await ncu({
packageFile: './packages/app/package.json',
filter: ['react', 'react-dom'],
target: 'latest',
upgrade: true, // write back to disk
})
console.log(upgraded) // { 'react': '^18.3.1', 'react-dom': '^18.3.1' }
Run it directly with Node:
node ./scripts/check-deps.ts
Recommended workflows
Safest upgrade path
- Ensure the working tree is committed.
- Run
ncu --cooldown 7to skip recently published versions. - Run
ncu -uto write updates. - Run
npm install(or the equivalent for the active package manager). - Run the test suite and commit if green.
Detect breaking upgrades automatically
ncu --doctor -u
Reverts broken upgrades one at a time and prints the offender.
Monorepos
# All workspaces, including the root.
ncu -uw
# All packages.json files under the cwd.
ncu --deep -u
# A specific glob, merging root config.
ncu --packageFile 'packages/*/package.json' --mergeConfig -u
Custom registry / private mirror
ncu --registry https://npm.example.com --packageManager npm
# Or a static JSON catalog hosted anywhere.
ncu --registry https://example.com/versions.json --registryType json
Pitfalls and gotchas
ncuonly writespackage.json. Lockfile andnode_modulesupdates require a separate install step.--doctormodifies the lockfile andnode_modules. Use a clean tree.- The default CLI name
ncucollides withncu-weather-cliand Nvidia CUDA'sncuon some systems. Fall back tonpm-check-updatesif output is unexpected. - On Windows, prefer
--packageFile package.jsonifncuappears to hang. It is sometimes waiting for stdin. - The cooldown value is read from
min-release-age(npm),npmMinimalAgeGate(yarn), orpnpm-workspace.yaml'sminimumReleaseAge(pnpm) when--cooldownis not given. - Pure ESM since v21.0.0.
.ncurc.jsmust be ESM (export default); CJS configs need.cjsextension. --format cooldownrequires registry time data. Some mirrors do not expose it. Use a public registry if nothing is reported.
Verification cheatsheet
# Show all CLI options.
ncu --help
# Extended help for a single flag.
ncu --help --filter
ncu --help --target
ncu --help --cooldown
ncu --help --doctor
FAQ
What does the npm-check-updates skill do?
Upgrade package.json dependencies to the latest versions with npm-check-updates (ncu). Use when the user wants to check for outdated dependencies, upgrade package versions, filter or reject specific packages, target a specific version range (latest, greatest, minor, patch, semver, @tag), scan a single or multiple package files (--deep, --workspaces, --packageFile), run interactive selection (--interactive), detect breaking upgrades by running tests after each bump (--doctor), defend against supply-chain attacks with --cooldown, query private or alternate registries, or use the programmatic API from a .ncurc.js config or a Node module.
How do I install npm-check-updates?
Run npx skills add https://github.com/ilteoood/harness --skill npm-check-updates in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/npm-check-updates/ (personal) or .claude/skills/npm-check-updates/ (project).
Which AI agents can use npm-check-updates?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is npm-check-updates safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains npm-check-updates?
It is published by ilteoood in ilteoood/harness. It has 438 recorded installs.
More from ilteoood/harness
github-issues
ilteoood/harness
Create, update, and manage GitHub issues using MCP tools. Use this skill when users want to create bug reports, feature requests, or task issues, update existing issues, add labels/assignees/milestones, manage repository labels, set issue fields (dates, priority, custom fields), set issue types, manage issue workflows, link issues, add dependencies, or track blocked-by/blocking relationships. Triggers on requests like "create an issue", "file a bug", "request a feature", "update issue X", "set the priority", "set the start date", "create a label", "rename a label", "list repo labels", "link issues", "add dependency", "blocked by", "blocking", or any GitHub issue management task.
git-commit
ilteoood/harness
Execute git commit with conventional commit message analysis, intelligent staging, and message generation. Use when user asks to commit changes, create a git commit, or mentions "/commit". Supports: (1) Auto-detecting type and scope from changes, (2) Generating conventional commit messages from diff, (3) Interactive commit with optional type/scope/description overrides, (4) Intelligent file staging for logical grouping
conventional-commit
ilteoood/harness
Prompt and workflow for generating conventional commit messages using a structured XML format. Guides users to create standardized, descriptive commit messages in line with the Conventional Commits specification, including instructions, examples, and validation.
create-technical-spike
ilteoood/harness
Create time-boxed technical spike documents for researching and resolving critical development decisions before implementation.
codeql
ilteoood/harness
Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
create-specification
ilteoood/harness
Create a new specification file for the solution, optimized for Generative AI consumption.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.