package-outdated-why

npm outdated shows 50 packages. Which ones MATTER?

The only tool that combines outdated packages + security vulnerabilities + breaking change context + dependency freshness into one prioritized view.

What's New in v0.2.0

• Libyear Metrics - Track how "stale" your dependencies are (inspired by libyear.com)
• Unused Detection - Find dependencies you're not actually using
• Health Check - Identify deprecated and unmaintained packages
• Full Analysis - Run all checks at once with full command

The Problem

You run npm outdated and get this:

Package          Current  Wanted  Latest
lodash           4.17.20  4.17.21 4.17.21
react            17.0.2   17.0.2  18.2.0
axios            1.6.0    1.6.7   1.6.7
eslint           8.56.0   8.57.0  9.0.0
# ... 45 more packages 😱

Now what?

• Which ones have security issues? 🔒
• Which ones will break my code? 💥
• Which ones are safe to update? ✅
• How old are my dependencies? 📅
• Am I using all of them? 🔍

The Solution

npx package-outdated-why

╭─────────────────────────────────────────╮
│   📦 package-outdated-why               │
│   Know which updates actually matter    │
│                                         │
│   Security Score: 65/100                │
│   Freshness Score: 72/100               │
╰─────────────────────────────────────────╯

📊 Summary:
   Total outdated: 50
   🔴 Critical: 2  🟡 Important: 8  🟢 Safe: 35  ⏭️ Skip: 5

📅 Dependency Freshness:
   Total drift: 3.2 libyears
   Most outdated: lodash (1.5 years)

🔴 CRITICAL - Update immediately:
   • lodash: 4.17.20 → 4.17.21 [EASY]
     Security vulnerability (high): Prototype Pollution
     ⚠️  [HIGH] CVE-2021-23337

🟡 IMPORTANT - Review before updating:
   • react: 17.0.2 → 18.2.0 [MEDIUM]
     Major update: Concurrent rendering, automatic batching
     📚 Migration guide: https://react.dev/blog/2022/03/29/react-v18

Why This Tool?

| Tool | Outdated | Security | Breaking Changes | Libyear | Unused | Health | |------|----------|----------|------------------|---------|--------|--------| | npm outdated | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | npm audit | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | | npm-check-updates | ✅ | ❌ | Color only | ❌ | ❌ | ❌ | | npm-check | ✅ | ❌ | ❌ | ❌ | ✅ | ❌ | | libyear | ✅ | ❌ | ❌ | ✅ | ❌ | ❌ | | depcheck | ❌ | ❌ | ❌ | ❌ | ✅ | ❌ | | package-outdated-why | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |

We're the only tool that combines everything into one command.

Installation

No installation needed! Use with npx:

npx package-outdated-why

Or install globally:

npm install -g package-outdated-why

Commands

analyze (default)

Full analysis with prioritized updates:

# Run analysis
npx package-outdated-why

# Save as markdown report
npx package-outdated-why -f markdown -o report.md

# JSON output for CI/CD
npx package-outdated-why -f json

# CI mode - exit 1 if critical vulnerabilities
npx package-outdated-why --ci

libyear

Measure dependency freshness:

npx package-outdated-why libyear

📅 Dependency Freshness (Libyear Metrics)

   Total drift: 3.2 libyears
   Average age: 0.15 years per dependency
   Most outdated: lodash (1.5 years)

   📊 Version breakdown:
      Major: 5 behind
      Minor: 12 behind
      Patch: 8 behind

   Freshness Score: 72/100

unused

Find unused dependencies:

npx package-outdated-why unused

🔍 Dependency Analysis

   ⚠️  Potentially unused (3):
      • lodash
      • moment
      • underscore

   📦 Dev packages in dependencies:
      • @types/node → move to devDependencies

health

Check package health:

npx package-outdated-why health

🏥 Package Health Check

   ⛔ Deprecated packages (1):
      • request - find alternative!

   😴 Unmaintained (2+ years) (2):
      • moment
      • node-uuid

   ✅ 45 packages are healthy!

full

Run all checks at once:

npx package-outdated-why full

# Save comprehensive report
npx package-outdated-why full -o full-report.md

quick

Just the numbers:

npx package-outdated-why quick

📊 Quick Summary:

   Security Score: 65/100

   🔴 Critical: 2
   🟡 Important: 8
   🟢 Safe: 35
   ⏭️ Skip: 5
   Total: 50

   🚨 Fix 2 critical vulnerabilities immediately!
   Effort: ~4 hours

fix

Get commands in order of priority:

npx package-outdated-why fix

why <package>

Deep dive into a specific package:

npx package-outdated-why why react

Programmatic Usage

import {
  analyzePackages,
  calculateLibyearMetrics,
  detectUnused,
  getHealthSummary
} from 'package-outdated-why';

// Full analysis
const result = analyzePackages();
console.log(`Security Score: ${result.securityScore}/100`);
console.log(`Critical: ${result.critical.length}`);

// Libyear metrics
const libyear = calculateLibyearMetrics(outdated);
console.log(`Total drift: ${libyear.totalLibyears} libyears`);
console.log(`Freshness: ${libyear.freshnessScore}/100`);

// Unused detection
const unused = detectUnused();
console.log(`Unused: ${unused.unused.join(', ')}`);

// Health check
const health = getHealthSummary(packageNames);
console.log(`Deprecated: ${health.deprecated.join(', ')}`);

CI/CD Integration

GitHub Actions

- name: Check dependencies
  run: npx package-outdated-why --ci

- name: Generate full report
  run: npx package-outdated-why full -o deps-report.md

- name: Upload report
  uses: actions/upload-artifact@v3
  with:
    name: dependency-report
    path: deps-report.md

How It Works

🔴 Critical (Update Immediately)

Security vulnerabilities from npm audit

🟡 Important (Review First)

Breaking changes with migration guides for 40+ packages

🟢 Safe (Update Anytime)

Backward-compatible patch/minor updates

⏭️ Skip (Low Priority)

Dev dependencies with low risk

📅 Libyear Metrics

• Total drift: Sum of years each package is behind
• Freshness Score: 0-100 (100 = all current)
• Pulse: Days since latest update available

Changelog

v0.2.0

• Added libyear command for dependency freshness metrics
• Added unused command to detect unused dependencies
• Added health command to check for deprecated/unmaintained packages
• Added full command to run all analyses
• Added freshness score to summary
• Improved TypeScript types and exports

v0.1.0

• Initial release
• Outdated package analysis
• Security vulnerability detection
• Breaking change context with migration guides
• Effort estimation

Supported Packages

Migration guides and effort estimates for 40+ popular packages:

| Category | Packages | |----------|----------| | Frontend | React, Vue, Angular, Svelte, Next.js | | Build | TypeScript, Webpack, Vite, esbuild | | Testing | ESLint, Jest, Vitest, Playwright | | Backend | Express, Fastify, Hono | | Database | Mongoose, Prisma, Sequelize, TypeORM | | UI | Tailwind CSS, MUI, Chakra UI |

Support This Tool ☕

100% free and open source.

If it saved you time, consider:

💚 Buy Me a Coffee

License

MIT

Contributing

Contributions welcome! GitHub

PRs especially welcome for:

• Adding migration guides for more packages
• Improving effort estimates
• Better security advisory detection
• Unused detection improvements

Stop guessing. Know which updates actually matter.