2807

I copied package.json from another project and now want to bump all of the dependencies to their latest versions since this is a fresh project and I don't mind fixing something if it breaks.

What's the easiest way to do this?

The best way I know is to run npm info express version and then update each dependency in package.json manually. There must be a better way.

{
  "name": "myproject",
  "description": "my node project",
  "version": "1.0.0",
  "dependencies": {
    "express": "^3.0.3", // how do I get these bumped to latest?
    "mongodb": "^1.2.5",
    "underscore": "^1.4.2"
  }
}

For Yarn-specific solutions, refer to this Stack Overflow question.

8
  • 5
    There NEEDS to be some better answers here. Obviously with dependency resolution, you can't always have the latest version of everything. Maximizing the greatest number of latest versions of modules is just that, some sort of optimization problem. But NPM doesn't know which modules you want to be most recent more than others. It would be cool if there was something like this: npm update --latest x y z, where x y z are the modules you want to be as recent as possible and all other modules will follow with their most recent compatible version. Commented Oct 26, 2016 at 17:18
  • 4
    npm will correctly handle version conflicts between shared dependencies by downloading the correct one for each. So, if Dep A depends on Dep C v1.0.0 and Dep B depends on Dep C v2.0.0, they will each be installed and used appropriately. Therefore, you are free to install the latest of any packages you would like. Commented Oct 26, 2016 at 20:59
  • Try this to force upgrade: npm outdated | sed '1d; s/ .*/@latest/' | xargs npm i --save
    – miorey
    Commented Aug 23, 2019 at 14:53
  • I'm always checking this answer. But I see that it has slipped in the Google results. Hopefully this comment will help push it's relevance back up!!
    – Zach Smith
    Commented Sep 9, 2019 at 5:42
  • @RaineRevere Seems something has happened about this during 2017 (npm 5.0). Would you be so kind and check stackoverflow.com/questions/16525430/… and maybe add a reference to it? Some answers below mention 'npm outdated' and 'nom update' but they are lost in the dust. I found your question by search but the other one seems more up-to-date.
    – akauppi
    Commented Nov 23, 2019 at 17:54

42 Answers 42

3425

It looks like npm-check-updates is the only way to make this happen now.

npm i -g npm-check-updates
ncu -u
npm install

Or using npx (so you don't have to install a global package):

npx npm-check-updates -u
npm install 

On npm <3.11:

Simply change every dependency's version to *, then run npm update --save. (Note: broken in recent (3.11) versions of npm).

Before:

  "dependencies": {
    "express": "*",
    "mongodb": "*",
    "underscore": "*",
    "rjs": "*",
    "jade": "*",
    "async": "*"
  }

After:

  "dependencies": {
    "express": "~3.2.0",
    "mongodb": "~1.2.14",
    "underscore": "~1.4.4",
    "rjs": "~2.10.0",
    "jade": "~0.29.0",
    "async": "~0.2.7"
  }

Of course, this is the blunt hammer of updating dependencies. It's fine if—as you said—the project is empty and nothing can break.

On the other hand, if you're working in a more mature project, you probably want to verify that there are no breaking changes in your dependencies before upgrading.

To see which modules are outdated, just run npm outdated. It will list any installed dependencies that have newer versions available.

For Yarn specific solution, refer to this Stack Overflow answer.

31
  • 16
    @thefourtheye: You generally shouldn't leave * in package.json since you might end up automatically installing a new module version with breaking changes that break your app. Since we're using --save here, the * is replaced with each package's current version.
    – josh3736
    Commented Aug 1, 2013 at 14:15
  • 53
    I'm not able to get this to work. Has something changed with npm since this answer was posted? When I use the wildcard and then npm install --save the wildcard is left in my package.json. Commented Dec 9, 2013 at 22:05
  • 16
    Unfortunately, using update doesn't work either, for me. I'm still left with the wildcards. Is there any documentation about this that you know of, or any other resources I might look at? Commented Dec 30, 2013 at 21:03
  • 133
    A bit old but that might help other people: github.com/tjunnone/npm-check-updates | Use npm install -g npm-check-updates to install, then npm-check-updates to check if your dependencies have updates, and npm-check-updates -u to update your package.json versions. Then it's just npm install and it will download new versions.
    – RaphaelDDL
    Commented Jan 15, 2014 at 13:44
  • 7
    Your problem is probably coming from the fact that you try to update dev packages by typing npm update --save instead of npm update --save-dev. Commented Aug 19, 2014 at 21:44
1357

npm-check-updates is a utility that automatically adjusts a package.json file with the latest version of all dependencies.

See npm-check-updates

npm install -g npm-check-updates
ncu -u
npm install

A slightly less intrusive (avoids a global install) way of doing this if you have a modern version of npm is:

npx npm-check-updates -u
npm install
16
  • 208
    This should be available natively through npm command itself, indeed best solution so far to update the dependencies. Commented May 17, 2014 at 11:04
  • 7
    Should be part of npm natively, fully agree. However, it is not and this solution comes in like a breeze. Thank you.
    – Stefan
    Commented Jun 23, 2014 at 20:19
  • 3
    i assume you fellows are pushing [HARD] to get this into the core npm?
    – enorl76
    Commented Jan 28, 2015 at 22:02
  • 3
    @Batman Yes if you didn't install before. Otherwise use npm update. ncu just updates package.json. It doesn't install or update 'node_modules'.
    – Muzaffer
    Commented Dec 17, 2015 at 13:19
  • 4
    npx npm-check-updates -u was the answer for me Commented Jul 21, 2021 at 15:01
467

Updated for npm v2+

npm 2+ (Node.js 0.12+):

npm outdated
npm update
git commit package-lock.json

Ancient npm (circa 2014):

npm install -g npm-check-updates
npm-check-updates
npm shrinkwrap
git commit package-lock.json

Be sure to shrinkwrap your dependencies, or you may wind up with a dead project. I pulled out a project the other day and it wouldn't run, because my dependencies were all out of date/updated/a mess. If I'd shrinkwrapped, npm would have installed exactly what I needed.


Details

For the curious who make it this far, here is what I recommend:

Use npm-check-updates or npm outdated to suggest the latest versions.

# `outdated` is part of newer npm versions (2+)
npm outdated

# If you agree, update.
npm update

#       OR

# Install and use the `npm-check-updates` package.
npm install -g npm-check-updates

# Then check your project
npm-check-updates

# If you agree, update package.json.
npm-check-updates -u

Then do a clean install (without the rm I got some dependency warnings)

rm -rf node_modules
npm install

Lastly, save exact versions to npm-shrinkwrap.json with npm shrinkwrap

rm npm-shrinkwrap.json
npm shrinkwrap

Now, npm install will now use exact versions in npm-shrinkwrap.json

If you check npm-shrinkwrap.json into Git, all installs will use the exact same versions.

This is a way to transition out of development (all updates, all the time) to production (nobody touch nothing).

P.S.: Yarn is sending your package list to Facebook.

5
  • 1
    For sure. If you create and npm-shrinkwrap.json into source, and commit whenever you update, you can always 'go back to where you were'. I overlooked shrinkwrap feature when I started. Commented Dec 31, 2015 at 16:01
  • 38
    this does not answer the question. The question is how to update the latest version. npm update only updates to the semver version, not the latest.
    – gman
    Commented Sep 27, 2016 at 12:53
  • 1
    Would be great if npm update actually updated package.json. Per github.com/npm/npm/issues/13555 this is a bug which is not fixed after 2 years. npmjs.com/package/npm-check-updates is the current way to go
    – John B
    Commented Jun 4, 2018 at 0:51
  • I love the outdated option to see first what's to be updated .... nice one!!
    – Mr.P
    Commented Apr 11 at 6:03
  • npm outdated does not show minor package updates for me, only major ones. Commented May 29 at 7:08
234

To update one dependency to its lastest version without having to manually open the package.json and change it, you can run

npm install {package-name}@* {save flags?}

i.e.

npm install express@* --save

This flow is compatible with workspaces, i.e.

npm --workspace some/package install express@*

For reference, npm-install


Note: Some npm versions may need latest flag instead, i.e. npm install express@latest


As noted by user Vespakoen on a rejected edit, it's also possible to update multiple packages at once this way:

npm install --save package-nave@* other-package@* whatever-thing@*

He also apports a one-liner for the shell based on npm outdated. See the edit for code and explanation.


PS: I also hate having to manually edit package.json for things like that ;)

7
  • 9
    This solution is great. Quick and easy way to explicitly update a single package to the latest version without installing any new modules. I like npm-check-updates, but afaik it tries to keep all packages up to date, which isn't always what you want.
    – CatDadCode
    Commented Apr 3, 2015 at 18:45
  • 2
    Use npm outdated -l to show whether each package is a dependency or devDependency. Use npm install --save-dev to save as a devDependency. Commented Oct 20, 2016 at 5:03
  • 1
    @Chev: ncu can easily target a single or several packages with ncu express mocha chai. You can also exclude packages with ncu -x mocha. I agree the above is the simplest solution though for updating a single package. Commented Dec 27, 2016 at 1:05
  • 4
    I just used something similar that worked, from possibly more recent docs... uses "latest" instead of "*" npm install {package-name}@latest {save flags} Commented Aug 20, 2018 at 18:49
  • 2
    Many thanks, this solution is great and exactly what I am looking for. It allows you to update a particular package without the need to update every other dependency which may lead to unforeseen problems!
    – Dany Wehbe
    Commented Nov 20, 2018 at 10:13
218

If you happen to be using Visual Studio Code as your IDE, this is a fun little extension to make updating package.json a one click process.

note: After updating packages in package.json file, run npm update to install the new versions.

Version Lens

enter image description here

GitLab Repo

5
  • 2
    There's sublime text 3 version here: github.com/yavorsky/Bump, though a bit slow. Commented May 24, 2018 at 10:46
  • 17
    Worked beautifully, in case it is not clear to anyone, this simply checks the versions in your package.json against the latest npm repository versions, and allows you to click on a version to update the text content in your package.json. You then need to run "npm update" to tell npm to install the new versions.
    – MattG
    Commented Jun 8, 2018 at 11:08
  • 8
    Note that it is already possible to see the latest version of the package dependencies with a brief description in built-in Visual Studio Code by mouse hovering on the package entry: Built-in Package Version Hint Commented Aug 25, 2018 at 21:09
  • 4
    Note that it does not automatically install packages when clicking a code lens link! It simply updates the package.json version text.
    – RA.
    Commented Aug 30, 2019 at 23:22
  • 1
    This saved me a lot of time, I had to update all dependencies in a project. Thank you very much Commented Jun 11, 2023 at 19:29
78

This works as of npm 1.3.15.

"dependencies": {
  "foo": "latest"
}
4
  • 16
    Good to know. My guess is that this would generally be a bad practice on any production site because it will update to potentially backwards-incompatible versions automatically. The '~2' syntax locks you into a given major version number, which following semver will be backwards compatible. Commented Feb 7, 2014 at 18:21
  • 1
    You can always freeze deps on prod. Theres a command for that. -2 sounds ok. Commented Feb 20, 2014 at 17:50
  • 5
    I like using this along with npm shrinkwrap to freeze deps. Commented Jul 17, 2014 at 22:06
  • If we do this, then how do we know the actual version of that package? Say I had an entry called "react": "16.9.0" and then I added latest to it and ran npm i, after this how do I find which version of react is now in my project? since "react":"latest" is whats left in my package.json, not a number even after I did npm i Commented Feb 19, 2020 at 17:57
77
  1. Use * as the version for the latest releases, including unstable
  2. Use latest as version definition for the latest stable version
  3. Modify the package.json with exactly the latest stable version number using LatestStablePackages

Here is an example:

"dependencies": {
        "express": "latest"  // using the latest STABLE version
    ,   "node-gyp": "latest"    
    ,   "jade": "latest"
    ,   "mongoose": "*" // using the newest version, may involve the unstable releases
    ,   "cookie-parser": "latest"
    ,   "express-session": "latest"
    ,   "body-parser": "latest"
    ,   "nodemailer":"latest"
    ,   "validator": "latest"
    ,   "bcrypt": "latest"
    ,   "formidable": "latest"
    ,   "path": "latest"
    ,   "fs-extra": "latest"
    ,   "moment": "latest"
    ,   "express-device": "latest"
},
4
  • 3
    This is the best answer.
    – Peza
    Commented Sep 10, 2018 at 13:23
  • still the safest approach to take. Good answer.
    – klewis
    Commented Jan 21, 2020 at 17:15
  • "latest" also stops the thrashing that package.json does to your git commit history, each time a package version number changes. The only downside being that in a production release we need to freeze the package version numbers, so that the build does not break. Although we might be able to replace "latest" with the actual semvar values, by handling that in package.json with a run script for a command like npm run build. Commented Jun 7, 2022 at 9:06
  • Not sure if npm shrinkwrap is the way to go to freeze version numbers for a production release. But to convert "latest" into exact semvar numbers one could use something like "scripts": { "build" : "npx --yes npm-check-updates --upgrade" } in package.json. Commented Jun 7, 2022 at 9:40
65

To see which packages have newer versions available, then use the following command:

npm outdated

to update just one dependency just use the following command:

npm install yourPackage@latest

For example:

My package.json file has dependency:

"@progress/kendo-angular-dateinputs": "^1.3.1",

then I should write:

npm install @progress/kendo-angular-dateinputs@latest

What does --save-dev mean?

npm install @progress/kendo-angular-dateinputs@latest --save-dev

As npm install docs says:

-D, --save-dev: Package will appear in your devDependencies.

3
  • Nice but it looks like that --save (or --save-dev) is not mandatory for update.
    – Burrich
    Commented Jul 27, 2018 at 23:18
  • @Burrich yeah, you are right! Please, see my updated answer! Thanks!
    – StepUp
    Commented Mar 17, 2021 at 10:22
  • how does this answer the question to 'update each dependency'? Isn't this a manual solution by dependency, not a solution that updates all dependencies? And to the latest major version?
    – Joe
    Commented May 9, 2022 at 18:32
60

I really like how npm-upgrade works. It is a simple command line utility that goes through all of your dependencies and lets you see the current version compared to the latest version and update if you want.

Here is a screenshot of what happens after running npm-upgrade in the root of your project (next to the package.json file):

npm upgrade example

For each dependency you can choose to upgrade, ignore, view the changelog, or finish the process. It has worked great for me so far.

To be clear this is a third party package that needs to be installed before the command will work. It does not come with npm itself:

npm install -g npm-upgrade

Then from the root of a project that has a package.json file:

npm-upgrade
5
  • 2
    Hmm, npm-upgrade did not work for me, but npm upgrade did and it updated my package.json file which was exactly what I was looking for.
    – Grandizer
    Commented May 24, 2018 at 12:44
  • Hmm interesting, was there an error? The idea behind using npm-upgrade is that you get to see exactly what is being upgraded and pick and choose which ones get upgraded. npm upgrade may work fine for most people but sometimes you need to have a little more control when upgrading.
    – manncito
    Commented May 24, 2018 at 21:48
  • @Grandizer: upgrade is an alias for update, so there should be no difference between them. However, npm 6.2.0 is buggy, and may not udpate package.json. Commented Jul 25, 2018 at 1:39
  • 2
    You can also use this with npx: npx npm-upgrade - quite cool! :)
    – x-ray
    Commented Feb 26, 2019 at 23:37
  • Please review Why not upload images of code/errors when asking a question? (e.g., "Images should only be used to illustrate problems that can't be made clear in any other way, such as to provide screenshots of a user interface.") and do the right thing (it covers answers as well, and it also covers program (text) input and output). Thanks in advance. Commented Aug 31, 2023 at 16:42
50

The only caveat I have found with the best answer is that it updates the modules to the latest version. This means it could update to an unstable alpha build.

I would use that npm-check-updates utility. My group used this tool and it worked effectively by installing the stable updates.

As Etienne stated: install and run with this:

npm install -g npm-check-updates
npm-check-updates -u
npm install
4
  • 5
    rm -rf node_modules before npm install got rid of some dependency warnings for me. Commented Jun 2, 2015 at 22:24
  • 1
    Just in case you have "*" in package.json, simply change it to "0" or "0.0" or "0.0.0" before running npm-check-updates.
    – igorpavlov
    Commented Nov 3, 2015 at 12:44
  • You should link directly to whatever the "best answer above" is/was. While your answer stands alone, that explanation isn't clear.
    – isherwood
    Commented Jun 2, 2022 at 21:19
  • Which "best answer" method are you referring to exactly? (The top voted answer and its content can change over time. Also, according to others "latest" means latest stable version and "*" means also unstable?
    – xuiqzy
    Commented Apr 18 at 15:41
44

I use npm-check to achieve this.

npm i -g npm npm-check
npm-check -ug # To update globals
npm-check -u # To update locals

Enter image description here

Another useful command list which will keep exact version numbers in package.json:

npm cache clean
rm -rf node_modules/
npm i -g npm npm-check-updates
ncu -g # Update globals
ncu -u # Update locals
npm I

You can use yarn upgrade-interactive --latest if you are using Yarn.

2
  • 3
    yarn upgrade-interactive --latest is a better option now
    – goksel
    Commented Jul 14, 2022 at 13:15
  • wouldn't that install latest Major? That's not usually better.
    – Qwerty
    Commented Aug 19, 2023 at 16:56
30

Safe update

  1. Use npm outdated to discover dependencies that are out of date.

  2. Use npm update to perform safe dependency upgrades.

  3. Use npm install <packagename>@latest to upgrade to the latest major version of a package.

Breaking Update

  1. Use npx npm-check-updates -u.

  2. npm install to upgrade all dependencies to their latest major versions.

1
  • 2
    The commands listed in the answer are incorrect and will error out. Please note that npm install @latest should really be npm install <PACKAGE>@latest.
    – Alex
    Commented Aug 11, 2021 at 7:57
27

Here is a basic regex to match semantic version numbers so you can quickly replace them all with an asterisk.

Semantic Version Regex

([>|<|=|~|^|\s])*?(\d+\.)?(\d+\.)?(\*|\d+)

How to use

Select the package versions you want to replace in the JSON file.

screenshot:select the text you want to replace

Input the regex above and verify it's matching the correct text.

screenshot:input the semver regex above

Replace all matches with an asterisk.

screenshot:replace package versions with an asterisk

Run npm update --save

2
  • 1
    doesn't when there is number in a package name. i.e.: babel-preset-es2015, babel-preset-stage-0, hex2rgba. Maybe search for quote/double quote at the beggining: ('|")([>|<|=|~|^|\s])*?(\d+\.)?(\d+\.)?(\*|\d+)
    – rofrol
    Commented Sep 15, 2017 at 9:47
  • 1
    on any editor that supports multiple carets (ej Sublime Text) you can select the first : and press ctrl+d multiple times until you select them all, then go to the version number (press right arrow 2 times) and press ctrl space, then write "*" Commented Sep 18, 2017 at 2:47
22

If you want to use a gentle approach via a beautiful (for terminal) interactive reporting interface I would suggest using npm-check.

It's less of a hammer and gives you more consequential knowledge of, and control over, your dependency updates.

To give you a taste of what awaits here's a screenshot (scraped from the git page for npm-check):

enter image description here

1
22

As of npm version 5.2.0, there is a way to run this in a single line without installing any additional packages to your global npm registry nor locally to your application. This can be done by leveraging the new npx utility that's bundled with npm. (Click here to learn more.)

Run the following command in the root of your project:

npx npm-check-updates -u && npm i
0
21

This feature has been introduced in npm v5. Update to npm using npm install -g npm@latest and to update package.json:

  1. delete folder node_modules and package-lock.json (if you have any)

  2. run npm update. This will update the dependencies in package.json to the latest, based on semantic versioning.

To update to the very latest version, you can go with npm-check-updates.

18

I recently had to update several projects that were using npm and package.json for their gruntfile.js magic. The following Bash command (multiline command) worked well for me:

npm outdated --json --depth=0 | \
jq --ascii-output --monochrome-output '. | keys | .[]' | \
xargs npm install $1 --save-dev

The idea here:

To pipe the npm outdated output as JSON, to jq (jq is a JSON command line parser/query tool) (notice the use of --depth argument for npm outdated).

jq will strip the output down to just the top-level package name only. Finally xargs puts each LIBRARYNAME one at a time into a npm install LIBRARYNAME --save-dev command.

The above is what worked for me on a machine running: node=v0.11.10 osx=10.9.2 npm=1.3.24

This required: xargs (native to my machine I believe) and jq (I installed it with brew install jq).

Note: I only save the updated libraries to package.json inside of the JSON key devDependencies by using --save-dev. That was a requirement of my projects, quite possible not yours.

Afterwards, I check that everything is gravy with a simple

npm outdated --depth=0

Also, you can check the current top-level installed library versions with

npm list --depth=0
3
  • I love jq and use it almost everyday, but for this purpose I use simple awk instead: npm outdated --depth=0 | grep -v "^Package" | awk '{print $1}' | xargs npm install $1 --save-dev
    – Qorbani
    Commented Nov 10, 2014 at 2:55
  • 1
    I've been using cat package.json|jq -r '.devDependencies|keys|map(.+"@latest")|@sh'|xargs npm install --save-dev Commented Oct 14, 2015 at 14:16
  • 1
    Re "devDependancies": [sic]. Is it actually present? Not "devDependencies"? Commented Nov 2, 2023 at 3:58
17

If you use Yarn, the following command updates all packages to their latest version:

yarn upgrade --latest

From their documentation:

The upgrade --latest command upgrades packages the same as the upgrade command, but ignores the version range specified in package.json. Instead, the version specified by the latest tag will be used (potentially upgrading the packages across major versions).

2
14

Use Updtr!

Based on npm outdated, updtr installs the latest version and runs npm test for each dependency. If the test succeeds, updtr saves the new version number to your package.json. If the test fails, however, updtr rolls back its changes.

0
9

If you are using yarn, yarn upgrade-interactive is a really sleek tool that can allow you to view your outdated dependencies and then select which ones you want to update.

More reasons to use Yarn over npm. Heh.

3
9

Commands that I had to use to update package.json for NPM 3.10.10:

npm install -g npm-check-updates
ncu -a
npm install

Background:

I was using the latest command from @josh3736 but my package.json was not updated. I then noticed the description text when running npm-check-updates -u:

The following dependency is satisfied by its declared version range, but the installed version is behind. You can install the latest version without modifying your package file by using npm update. If you want to update the dependency in your package file anyway, run ncu -a.

Reading the documentation for npm-check-updates you can see the difference:

https://www.npmjs.com/package/npm-check-updates

-u, --upgrade: overwrite package file

-a, --upgradeAll: include even those dependencies whose latest version satisfies the declared semver dependency

ncu is an alias for npm-check-updates as seen in the message when typing npm-check-updates -u:

[INFO]: You can also use ncu as an alias
1
  • In npm-check-updates v3, -a is the default behavior, and overwriting the package.json is left solely to the -u option. Commented May 1, 2019 at 15:40
7

If you're looking for an easier solution that doesn't involve installing npm packages, I'd checkout updatepackagejson.com

updatepackagejson.com

0
7

I solved this by using the instructions from npm-check-updates:

npm install -g npm-check-updates
ncu
ncu -u # To update all the dependencies to the latest
ncu -u "specific module name"  # In case you want to update specific dependencies to the latest
1
  • also there is an option --target minor to update only minor versions Commented Jan 29 at 13:56
6

If you don't want to install global npm-check-updates you can simply run that:

node -e "const pk = JSON.parse(require('fs').readFileSync('package.json', 'utf-8'));require('child_process').spawn('npm', ['install', ...Object.keys(Object.assign({},pk.dependencies, pk.devDependencies)).map(a=>a+'@latest')]).stdout.on('data', d=>console.log(d.toString()))"
2
  • Love it! Best answer here. No unwanted dependencies required for a one-time task. Thank you kind sir!
    – David Roth
    Commented Nov 6, 2021 at 19:35
  • this command not work for us @Node.js v18.14.1 + Windows
    – vlatko606
    Commented Feb 24, 2023 at 14:20
6

As it's almost been 10 years since the original question, and many of the answers are either outdated or not recommended.

I would use something which is package manager-agnostic, i.e., can work with npm, pnpm, Yarn or others.

Lately I have been using taze.

You can either add it to your development dependencies and run from there or run without installation with npx taze or pnpx taze, etc.

6

Try the following command if you are using npm 5 and Node.js 8:

npm update --save
1
  • 3
    The update command does not seem to bump dependencies beyond the original definition. If package.json declares "1.2.3" exactly you won't get 1.2.4. That can be good or bad :) Commented Jan 17, 2018 at 12:05
5

I found another solution for recent versions of NPM. I want to replace all the "*" dependencies with the explicit latest version number. None of the methods discussed has worked for me.

I did:

  1. Replace all "*" with "^0.0.0"
  2. Run npm-check-updates -u

Everything in package.json now is updated to the last version.

5

The commands in previous answers are unsafe, because you might break your module when switching versions. Instead I recommend the following:

  • Set the actual current Node.js modules version into package.json using the npm shrinkwrap command.
  • Update each dependency to the latest version if it does not break your tests using the next-update command line tool
npm install -g next-update
// from your package
next-update
2
  • 1
    Backwards-incompatible changes do need to be safeguarded against for active projects. The OP is more concerned with starting a new project where you want to break things now rather than later and have the latest versions to work from. Commented Dec 12, 2014 at 16:05
  • Re "the next-update command line tool": Which you presumably wrote? That should be revealed. Related (Help Center): How to not be a spammer Commented Nov 2, 2023 at 3:18
4

The following code (which was accepted) wrote me something like "it takes too long blah-blah" and did nothing. Probably using the global flag was the problem, idk.

npm i -g npm-check-updates
ncu -u
npm install

I decided to use my text editor and follow a semi-manual approach instead.

I copied a list like this (just a lot longer) from the dev dependencies of my package.json to the notepad++ text editor:

"browserify": "10.2.6",
"expect.js": "^0.3.1",
"karma": "^0.13.22",
"karma-browserify": "^5.2.0",

I set the search mode to regular expression, used the ^\s*"([^"]+)".*$ pattern to get the package name and replaced it with npm uninstall \1 --save-dev \nnpm install \1 --save-dev. Clicked on "replace all". The otput was this:

npm uninstall browserify --save-dev 
npm install browserify --save-dev
npm uninstall expect.js --save-dev 
npm install expect.js --save-dev
npm uninstall karma --save-dev 
npm install karma --save-dev
npm uninstall karma-browserify --save-dev 
npm install karma-browserify --save-dev

I copied it back to bash and hit enter. Everything was upgraded and working fine. That's all.

"browserify": "^16.1.0",
"expect.js": "^0.3.1",
"karma": "^2.0.0",
"karma-browserify": "^5.2.0",

I don't think it is a big deal, since you have to do it only every now and then, but you can easily write a script, which parses the package.json and upgrades your packages. I think it is better this way, because you can edit your list if you need something special, for example keeping the current version of a lib.

2
  • 1
    With npm-check-updates, the hanging terminal is a known issue on Windows. Try adding --packageFile package.json so that knows not to wait for stdin. Commented May 1, 2019 at 15:48
  • @RaineRevere Thanks!
    – inf3rno
    Commented May 1, 2019 at 19:46
4

It's wild to me that 90% of answers is some variant of "use npm-check-updates". Here's what I do (relevant code):

{
  "devDependencies": {
    "updates": "^13.0.5" // the version here could be "latest" or "*" tbh...
  },
  "scripts": {
    "test:dependencies": "updates --update ./",
  }
}

Running npm run test:dependencies (or whatever your dependency update script is called) will check your package.json for the latest versions of every package listed, and it'll let you know when the latest version was published. Run npm i after that and you'll be up to date!

Also, unlike npm-check-updates, updates has zero dependencies (ncu has 29, at the time of this post).

1

Not the answer you're looking for? Browse other questions tagged or ask your own question.