@juit/check-updates 2.0.0

package/LICENSE.md

@@ -0,0 +1,211 @@
+# Apache License
+
+Version 2.0, January 2004
+
+[http://www.apache.org/licenses/](http://www.apache.org/licenses/)
+
+##### TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+### 1. Definitions.
+
+"**License**" shall mean the terms and conditions for use, reproduction,
+and distribution as defined by Sections 1 through 9 of this document.
+
+"**Licensor**" shall mean the copyright owner or entity authorized by
+the copyright owner that is granting the License.
+
+"**Legal Entity**" shall mean the union of the acting entity and all
+other entities that control, are controlled by, or are under common
+control with that entity. For the purposes of this definition,
+"**control**" means **(i)** the power, direct or indirect, to cause the
+direction or management of such entity, whether by contract or
+otherwise, _or_ **(ii)** ownership of fifty percent (50%) or more of
+the outstanding shares, _or_ **(iii)** beneficial ownership of such
+entity.
+
+"**You**" (or "**Your**") shall mean an individual or Legal Entity
+exercising permissions granted by this License.
+
+"**Source**" form shall mean the preferred form for making
+modifications, including but not limited to software source code,
+documentation source, and configuration files.
+
+"**Object**" form shall mean any form resulting from mechanical
+transformation or translation of a Source form, including but not
+limited to compiled object code, generated documentation, and
+conversions to other media types.
+
+"**Work**" shall mean the work of authorship, whether in Source or
+Object form, made available under the License, as indicated by a
+copyright notice that is included in or attached to the work (an example
+is provided in the Appendix below).
+
+"**Derivative Works**" shall mean any work, whether in Source or Object
+form, that is based on (or derived from) the Work and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship. For the purposes
+of this License, Derivative Works shall not include works that remain
+separable from, or merely link (or bind by name) to the interfaces of,
+the Work and Derivative Works thereof.
+
+"**Contribution**" shall mean any work of authorship, including the
+original version of the Work and any modifications or additions to that
+Work or Derivative Works thereof, that is intentionally submitted to
+Licensor for inclusion in the Work by the copyright owner or by an
+individual or Legal Entity authorized to submit on behalf of the
+copyright owner. For the purposes of this definition, "**submitted**"
+means any form of electronic, verbal, or written communication sent to
+the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems,
+and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "**Not a
+Contribution**".
+
+"**Contributor**" shall mean Licensor and any individual or Legal Entity
+on behalf of whom a Contribution has been received by Licensor and
+subsequently incorporated within the Work.
+
+### 2. Grant of Copyright License.
+
+Subject to the terms and conditions of this License, each Contributor
+hereby grants to You a perpetual, worldwide, non-exclusive, no-charge,
+royalty-free, irrevocable copyright license to reproduce, prepare
+Derivative Works of, publicly display, publicly perform, sublicense,
+and distribute the Work and such Derivative Works in Source or Object
+form.
+
+### 3. Grant of Patent License.
+
+Subject to the terms and conditions of this License, each Contributor
+hereby grants to You a perpetual, worldwide, non-exclusive, no-charge,
+royalty-free, irrevocable (except as stated in this section) patent
+license to make, have made, use, offer to sell, sell, import, and
+otherwise transfer the Work, where such license applies only to those
+patent claims licensable by such Contributor that are necessarily
+infringed by their Contribution(s) alone or by combination of their
+Contribution(s) with the Work to which such Contribution(s) was
+submitted. If You institute patent litigation against any entity
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+the Work or a Contribution incorporated within the Work constitutes
+direct or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate as of
+the date such litigation is filed.
+
+### 4. Redistribution.
+
+You may reproduce and distribute copies of the Work or Derivative Works
+thereof in any medium, with or without modifications, and in Source or
+Object form, provided that You meet the following conditions:
+
+<ol type="a">
+  <li>You must give any other recipients of the Work or Derivative Works
+    a copy of this License; and
+  <li>You must cause any modified files to carry prominent notices
+    stating that You changed the files; and
+  <li>You must retain, in the Source form of any Derivative Works that
+    You distribute, all copyright, patent, trademark, and attribution
+    notices from the Source form of the Work, excluding those notices
+    that do not pertain to any part of the Derivative Works; and
+  <li>If the Work includes a "NOTICE" text file as part of its
+    distribution, then any Derivative Works that You distribute must
+    include a readable copy of the attribution notices contained within
+    such NOTICE file, excluding those notices that do not pertain to any
+    part of the Derivative Works, in at least one of the following
+    places: within a NOTICE text file distributed as part of the
+    Derivative Works; within the Source form or documentation, if
+    provided along with the Derivative Works; or, within a display
+    generated by the Derivative Works, if and wherever such third-party
+    notices normally appear. The contents of the NOTICE file are for
+    informational purposes only and do not modify the License. You may
+    add Your own attribution notices within Derivative Works that You
+    distribute, alongside or as an addendum to the NOTICE text from the
+    Work, provided that such additional attribution notices cannot be
+    construed as modifying the License.
+</ol>
+
+You may add Your own copyright statement to Your modifications and may
+provide additional or different license terms and conditions for use,
+reproduction, or distribution of Your modifications, or for any such
+Derivative Works as a whole, provided Your use, reproduction, and
+distribution of the Work otherwise complies with the conditions stated
+in this License.
+
+### 5. Submission of Contributions.
+
+Unless You explicitly state otherwise, any Contribution intentionally
+submitted for inclusion in the Work by You to the Licensor shall be
+under the terms and conditions of this License, without any additional
+terms or conditions. Notwithstanding the above, nothing herein shall
+supersede or modify the terms of any separate license agreement you may
+have executed with Licensor regarding such Contributions.
+
+### 6. Trademarks.
+
+This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as
+required for reasonable and customary use in describing the origin of
+the Work and reproducing the content of the NOTICE file.
+
+### 7. Disclaimer of Warranty.
+
+Unless required by applicable law or agreed to in writing, Licensor
+provides the Work (and each Contributor provides its Contributions) on
+an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+express or implied, including, without limitation, any warranties or
+conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR
+A PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+### 8. Limitation of Liability.
+
+In no event and under no legal theory, whether in tort (including
+negligence), contract, or otherwise, unless required by applicable law
+(such as deliberate and grossly negligent acts) or agreed to in writing,
+shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any
+character arising as a result of this License or out of the use or
+inability to use the Work (including but not limited to damages for loss
+of goodwill, work stoppage, computer failure or malfunction, or any and
+all other commercial damages or losses), even if such Contributor has
+been advised of the possibility of such damages.
+
+### 9. Accepting Warranty or Additional Liability.
+
+While redistributing the Work or Derivative Works thereof, You may
+choose to offer, and charge a fee for, acceptance of support, warranty,
+indemnity, or other liability obligations and/or rights consistent with
+this License. However, in accepting such obligations, You may act only
+on Your own behalf and on Your sole responsibility, not on behalf of any
+other Contributor, and only if You agree to indemnify, defend, and hold
+each Contributor harmless for any liability incurred by, or claims
+asserted against, such Contributor by reason of your accepting any
+such warranty or additional liability.
+
+##### END OF TERMS AND CONDITIONS
+
+## APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following
+boilerplate notice, with the fields enclosed by brackets "[]"
+replaced with your own identifying information. (Don't include the
+brackets!)  The text should be enclosed in the appropriate comment
+syntax for the file format. We also recommend that a file or class name
+and description of purpose be included on the same "printed page" as the
+copyright notice for easier identification within third-party archives.
+
+> #### Copyright [yyyy] [name of copyright owner]
+>
+> Licensed under the Apache License, Version 2.0 (the "License");
+> you may not use this file except in compliance with the License.
+> You may obtain a copy of the License at
+>
+> [http://www.apache.org/licenses/](http://www.apache.org/licenses/)
+>
+> Unless required by applicable law or agreed to in writing, software
+> distributed under the License is distributed on an "AS IS" BASIS,
+> WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+> See the License for the specific language governing permissions and
+> limitations under the License.

package/NOTICE.md

@@ -0,0 +1,13 @@
+# Copyright 2021-2023 Juit GmbH
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+[http://www.apache.org/licenses/](http://www.apache.org/licenses/)
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -0,0 +1,42 @@
+Dependencies Update Checker
+===========================
+
+This package contains a simple script to update the dependencies of a given
+package file.
+
+By default it will _extend_ the semantics of `semver` checking for _minor_
+version updates for tilde ranges (`~x.y.z`) and checking for _major_ version
+updates for caret ranges (`^x.y.z`).
+
+To adhere to the standard `semver` rules simply specify the `--strict` option.
+
+When installed, the `check-updates` script can be invoked directly:
+
+```
+$ check-updates --help
+check-updates [--options ...] [package.json ...]
+
+Options:
+  -h, --help     Show help                                             [boolean]
+  -s, --strict   Strictly adhere to semver rules for tilde (~x.y.z)
+                 and caret (^x.y.z) dependency ranges                  [boolean]
+  -q, --quick    Consider dev/peer/optional dependency updates if and
+                 only if the main depenencies also had updates         [boolean]
+  -d, --debug    Output debugging informations                         [boolean]
+  -b, --bump     Bump the version of the package file on changes
+                                            [choices: "major", "minor", "patch"]
+  -x, --dry-run  Only process changes without writing to disk          [boolean]
+  -v, --version  Show version number                                   [boolean]
+
+Multiple files (or globs) can be specified on the command line.
+
+When no files are specified, the default is to process the "package.json" file
+in the current directory
+$
+```
+
+Legal
+-----
+
+* [Copyright Notice](NOTICE.md)
+* [License](LICENSE.md)

package/check-updates.js

@@ -0,0 +1,321 @@
+#!/usr/bin/env node
+"use strict";
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+
+// dist/npmrc.cjs
+var require_npmrc = __commonJS({
+  "dist/npmrc.cjs"(exports2, module2) {
+    "use strict";
+    var __create2 = Object.create;
+    var __defProp2 = Object.defineProperty;
+    var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
+    var __getOwnPropNames3 = Object.getOwnPropertyNames;
+    var __getProtoOf2 = Object.getPrototypeOf;
+    var __hasOwnProp2 = Object.prototype.hasOwnProperty;
+    var __export = (target, all) => {
+      for (var name in all)
+        __defProp2(target, name, { get: all[name], enumerable: true });
+    };
+    var __copyProps2 = (to, from, except, desc) => {
+      if (from && typeof from === "object" || typeof from === "function") {
+        for (let key of __getOwnPropNames3(from))
+          if (!__hasOwnProp2.call(to, key) && key !== except)
+            __defProp2(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc2(from, key)) || desc.enumerable });
+      }
+      return to;
+    };
+    var __toESM2 = (mod, isNodeMode, target) => (target = mod != null ? __create2(__getProtoOf2(mod)) : {}, __copyProps2(
+      // If the importer is in node compatibility mode or this is not an ESM
+      // file that has been converted to a CommonJS file using a Babel-
+      // compatible transform (i.e. "__esModule" has not been set), then set
+      // "default" to the CommonJS "module.exports" for node compatibility.
+      isNodeMode || !mod || !mod.__esModule ? __defProp2(target, "default", { value: mod, enumerable: true }) : target,
+      mod
+    ));
+    var __toCommonJS = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
+    var npmrc_exports = {};
+    __export(npmrc_exports, {
+      readNpmRc: () => readNpmRc
+    });
+    module2.exports = __toCommonJS(npmrc_exports);
+    var import_promises = __toESM2(require("node:fs/promises"));
+    var import_node_path = __toESM2(require("node:path"));
+    var import_ini = require("ini");
+    function replaceEnvironmentVariable(token) {
+      return token.replace(/^\$\{?([^}]*)\}?$/, (_match, ...vars) => {
+        return process.env[vars[0]] || "";
+      });
+    }
+    async function readFile(filename) {
+      try {
+        const data = await import_promises.default.readFile(filename, "utf8");
+        const npmrc = (0, import_ini.parse)(data);
+        for (const key in npmrc) {
+          if (typeof npmrc[key] === "string") {
+            npmrc[key] = replaceEnvironmentVariable(npmrc[key]);
+          }
+        }
+        return npmrc;
+      } catch (error) {
+        if (error.code === "ENOENT")
+          return {};
+        throw error;
+      }
+    }
+    async function readNpmRc(packageJsonFile) {
+      const local = readFile(import_node_path.default.resolve(packageJsonFile, "..", ".npmrc"));
+      const user = readFile(
+        process.env.NPM_CONFIG_USERCONFIG ? process.env.NPM_CONFIG_USERCONFIG : process.env.HOME ? import_node_path.default.resolve(process.env.HOME, ".npmrc") : ""
+      );
+      const global = readFile(
+        process.env.NPM_CONFIG_GLOBALCONFIG ? process.env.NPM_CONFIG_GLOBALCONFIG : "/etc/npmrc"
+      );
+      return Object.assign({}, ...await Promise.all([global, user, local]));
+    }
+  }
+});
+
+// dist/updater.cjs
+var require_updater = __commonJS({
+  "dist/updater.cjs"(exports2, module2) {
+    "use strict";
+    var __create2 = Object.create;
+    var __defProp2 = Object.defineProperty;
+    var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
+    var __getOwnPropNames3 = Object.getOwnPropertyNames;
+    var __getProtoOf2 = Object.getPrototypeOf;
+    var __hasOwnProp2 = Object.prototype.hasOwnProperty;
+    var __export = (target, all) => {
+      for (var name in all)
+        __defProp2(target, name, { get: all[name], enumerable: true });
+    };
+    var __copyProps2 = (to, from, except, desc) => {
+      if (from && typeof from === "object" || typeof from === "function") {
+        for (let key of __getOwnPropNames3(from))
+          if (!__hasOwnProp2.call(to, key) && key !== except)
+            __defProp2(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc2(from, key)) || desc.enumerable });
+      }
+      return to;
+    };
+    var __toESM2 = (mod, isNodeMode, target) => (target = mod != null ? __create2(__getProtoOf2(mod)) : {}, __copyProps2(
+      // If the importer is in node compatibility mode or this is not an ESM
+      // file that has been converted to a CommonJS file using a Babel-
+      // compatible transform (i.e. "__esModule" has not been set), then set
+      // "default" to the CommonJS "module.exports" for node compatibility.
+      isNodeMode || !mod || !mod.__esModule ? __defProp2(target, "default", { value: mod, enumerable: true }) : target,
+      mod
+    ));
+    var __toCommonJS = (mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod);
+    var updater_exports = {};
+    __export(updater_exports, {
+      processPackages: () => processPackages
+    });
+    module2.exports = __toCommonJS(updater_exports);
+    var import_promises = __toESM2(require("node:fs/promises"));
+    var import_glob = __toESM2(require("glob"));
+    var import_semver = __toESM2(require("semver"));
+    var import_npm_registry_fetch = __toESM2(require("npm-registry-fetch"));
+    var import_npmrc = require_npmrc();
+    var cache = {};
+    var { readFile, writeFile } = import_promises.default;
+    var [K, R, G, Y, B] = [0, 31, 32, 33, 34].map((x) => `\x1B[${x}m`);
+    async function processPackages(patterns, options) {
+      const { bump, quick, strict, debug, dryrun } = options;
+      function $debug(...args) {
+        if (debug && args)
+          console.log(`${R}[DEBUG]${K}`, ...args);
+      }
+      function getVersions(name, npmrc) {
+        if (name in cache) {
+          $debug(`Returning cached versions for ${Y}${name}${K}`);
+          return cache[name];
+        }
+        $debug(`Retrieving versions for package ${Y}${name}${K}`);
+        const range = new import_semver.default.Range(">=0.0.0", { includePrerelease: false });
+        return cache[name] = import_npm_registry_fetch.default.json(name, Object.assign({}, npmrc, { spec: name })).then((data) => {
+          return Object.entries(data.versions).filter(([, info]) => !info.deprecated).map(([version]) => version).filter((version) => range.test(version)).sort(import_semver.default.rcompare);
+        });
+      }
+      async function updateDependency(name, rangeString, npmrc) {
+        const match = /^\s*([~^])\s*(\d+(\.\d+(\.\d+)?)?)\s*$/.exec(rangeString);
+        if (!match) {
+          $debug(`Not processing range ${G}${rangeString}${K} for ${Y}${name}${K}`);
+          return rangeString;
+        }
+        const [, specifier, version] = match;
+        if (!strict) {
+          const r = rangeString;
+          rangeString = `>=${version}`;
+          if (specifier === "~")
+            rangeString += ` <${import_semver.default.inc(version, "major")}`;
+          $debug(`Extending version for ${Y}${name}${K} from ${G}${r}${K} to ${G}${rangeString}${K}`);
+        }
+        const range = new import_semver.default.Range(rangeString);
+        const versions = await getVersions(name, npmrc);
+        for (const v of versions) {
+          if (range.test(v))
+            return `${specifier}${v}`;
+        }
+        return `${specifier}${version}`;
+      }
+      async function processPackage(file) {
+        process.stdout.write(`Processing ${G}${file}${K} `);
+        const data = JSON.parse(await readFile(file, "utf8"));
+        if (data.name) {
+          process.stdout.write(`[${Y}${data.name}`);
+          if (data.version)
+            process.stdout.write(` ${data.version}`);
+          process.stdout.write(`${K}] `);
+        }
+        if (debug)
+          process.stdout.write("\n");
+        const npmrc = await (0, import_npmrc.readNpmRc)(file);
+        const changes2 = [];
+        let mainDependencyChanges = 0;
+        for (const type in data) {
+          if (!type.match(/[dD]ependencies$/))
+            continue;
+          if (type.match(/bundled?Dependencies/))
+            continue;
+          const kind = type.length > 12 ? ` [${type.slice(0, -12)}]` : "";
+          const dependencies = {};
+          const promises = Object.keys(data[type] || {}).sort().map(async (name) => {
+            const from = data[type][name];
+            const to = await updateDependency(name, from, npmrc);
+            if (!debug)
+              process.stdout.write(".");
+            if (from !== to) {
+              changes2.push({ name, from, to, kind });
+              if (type === "dependencies")
+                mainDependencyChanges++;
+            }
+            dependencies[name] = to;
+          });
+          await Promise.all(promises);
+          if (Object.keys(dependencies).length) {
+            data[type] = dependencies;
+          } else {
+            delete data[type];
+          }
+        }
+        if (debug)
+          process.stdout.write("Updated with");
+        if (!changes2.length) {
+          console.log(` ${R}no changes${K}`);
+          return 0;
+        }
+        changes2.sort(({ name: a }, { name: b }) => a < b ? -1 : a > b ? 1 : 0);
+        console.log(` ${R}${changes2.length} changes${K}`);
+        let lname = 0;
+        let lfrom = 0;
+        let lto = 0;
+        for (const { name, from, to } of changes2) {
+          lname = lname > name.length ? lname : name.length;
+          lfrom = lfrom > from.length ? lfrom : from.length;
+          lto = lto > to.length ? lto : to.length;
+        }
+        for (const { name, from, to, kind } of changes2) {
+          console.log(` * ${Y}${name.padEnd(lname)}${K}  :  ${G}${from.padStart(lfrom)}${K} -> ${G}${to.padEnd(lto)} ${B}${kind}${K}`);
+        }
+        if (quick && mainDependencyChanges === 0) {
+          console.log(`No changes to main dependencies, ${Y}ignoring ${changes2.length} other changes${K}`);
+          return 0;
+        }
+        if (bump) {
+          const bumped = import_semver.default.inc(data.version, bump);
+          console.log(` - Bumping version ${Y}${data.version}${K} -> ${G}${bumped}${K}`);
+          data.version = bumped;
+        }
+        if (dryrun) {
+          console.log(`Dry run, not writing ${G}${file}${K}`);
+          return 0;
+        } else {
+          await writeFile(file, JSON.stringify(data, null, 2) + "\n");
+          return changes2.length;
+        }
+      }
+      const files = await (0, import_glob.default)(patterns);
+      let changes = 0;
+      let newline = false;
+      for (const file of files) {
+        if (newline)
+          console.log();
+        const packageChanges = await processPackage(file);
+        newline = !!packageChanges;
+        changes += packageChanges;
+      }
+      return changes;
+    }
+  }
+});
+
+// dist/main.cjs
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames2 = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames2(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var yargs = __toESM(require("yargs"));
+var import_updater = require_updater();
+var parsed = yargs.usage("$0 [--options ...] [package.json ...]").help("h").alias("h", "help").alias("v", "version").option("s", {
+  alias: "strict",
+  type: "boolean",
+  description: [
+    "Strictly adhere to semver rules for tilde (~x.y.z)",
+    "and caret (^x.y.z) dependency ranges"
+  ].join("\n")
+}).option("q", {
+  alias: "quick",
+  type: "boolean",
+  description: [
+    "Consider dev/peer/optional dependency updates if and",
+    "only if the main depenencies also had updates"
+  ].join("\n")
+}).option("d", {
+  alias: "debug",
+  type: "boolean",
+  description: "Output debugging informations"
+}).options("b", {
+  alias: "bump",
+  coerce: (bump) => bump == true ? "patch" : bump,
+  choices: ["major", "minor", "patch"],
+  description: "Bump the version of the package file on changes"
+}).options("x", {
+  alias: "dry-run",
+  type: "boolean",
+  description: "Only process changes without writing to disk"
+}).epilogue([
+  "Multiple files (or globs) can be specified on the command line.\n",
+  'When no files are specified, the default is to process the "package.json" file in the current directory'
+].join("\n")).strictOptions().argv;
+Promise.resolve(parsed).then(({ b: bump, s: strict, q: quick, d: debug, x: dryrun, _: args = [] }) => {
+  const files = args.map((arg) => arg.toString());
+  if (!files.length)
+    files.push("package.json");
+  (0, import_updater.processPackages)(files, { strict, quick, debug, dryrun, bump }).then((changes) => {
+    process.exit(changes ? 0 : 1);
+  }).catch((error) => {
+    console.error(error);
+    process.exit(1);
+  });
+}).catch((error) => console.log(error));

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@juit/check-updates",
+  "version": "2.0.0",
+  "description": "Small and fast utility to update package dependencies",
+  "author": "Team Juit <developers@juit.com>",
+  "license": "Apache-2.0",
+  "bin": {
+    "check-updates": "check-updates.js"
+  },
+  "scripts": {
+    "build": "plug",
+    "coverage": "plug coverage",
+    "dev": "plug coverage -w src -w test",
+    "lint": "plug lint",
+    "test": "plug test",
+    "transpile": "plug transpile"
+  },
+  "dependencies": {
+    "glob": "^9.2.1",
+    "ini": "^3.0.1",
+    "npm-registry-fetch": "^14.0.3",
+    "semver": "^7.3.8",
+    "yargs": "^17.7.1"
+  },
+  "devDependencies": {
+    "@plugjs/build": "^0.2.4",
+    "@types/glob": "^8.1.0",
+    "@types/ini": "^1.3.31",
+    "@types/npm-registry-fetch": "^8.0.4",
+    "@types/semver": "^7.3.13",
+    "@types/yargs": "^17.0.22"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@github.com/juitnow/juit-check-updates.git"
+  },
+  "bugs": {
+    "url": "https://github.com/juitnow/juit-check-updates/issues"
+  },
+  "homepage": "https://github.com/juitnow/juit-check-updates#readme",
+  "files": [
+    "*.md",
+    "check-updates.js",
+    "src/"
+  ],
+  "directories": {
+    "test": "test"
+  },
+  "keywords": [
+    "check",
+    "dependencies",
+    "management",
+    "ncu",
+    "npm",
+    "package.json",
+    "updater",
+    "updates",
+    "upgrades",
+    "version"
+  ]
+}

package/src/main.ts

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+
+import * as yargs from 'yargs'
+
+import { processPackages } from './updater'
+
+type ReleaseType = 'major' | 'minor' | 'patch'
+
+/* ========================================================================== *
+ * CALL UP MAIN() AND DEAL WITH THE ASYNC PROMISE IT RETURNS                  *
+ * ========================================================================== */
+
+/* Parse command line arguments */
+const parsed = yargs
+    .usage('$0 [--options ...] [package.json ...]')
+    .help('h').alias('h', 'help').alias('v', 'version')
+    .option('s', {
+      alias: 'strict',
+      type: 'boolean',
+      description: [
+        'Strictly adhere to semver rules for tilde (~x.y.z)',
+        'and caret (^x.y.z) dependency ranges',
+      ].join('\n'),
+    })
+    .option('q', {
+      alias: 'quick',
+      type: 'boolean',
+      description: [
+        'Consider dev/peer/optional dependency updates if and',
+        'only if the main depenencies also had updates',
+      ].join('\n'),
+    })
+    .option('d', {
+      alias: 'debug',
+      type: 'boolean',
+      description: 'Output debugging informations',
+    })
+    .options('b', {
+      alias: 'bump',
+      coerce: ((bump): ReleaseType => bump == true ? 'patch' : bump),
+      choices: [ 'major', 'minor', 'patch' ] as ReleaseType[],
+      description: 'Bump the version of the package file on changes',
+    })
+    .options('x', {
+      alias: 'dry-run',
+      type: 'boolean',
+      description: 'Only process changes without writing to disk',
+    })
+    .epilogue([
+      'Multiple files (or globs) can be specified on the command line.\n',
+      'When no files are specified, the default is to process the "package.json" file in the current directory',
+    ].join('\n'))
+    .strictOptions()
+    .argv
+
+Promise.resolve(parsed).then(({ b: bump, s: strict, q: quick, d: debug, x: dryrun, _: args = [] }) => {
+  /* Normalize arguments and default to package.json in the current directory */
+  const files = args.map((arg) => arg.toString())
+  if (! files.length) files.push('package.json')
+
+  /* Process packages, one by one */
+  processPackages(files, { strict, quick, debug, dryrun, bump })
+      .then((changes) => {
+        process.exit(changes ? 0 : 1)
+      })
+      .catch((error) => {
+        console.error(error)
+        process.exit(1)
+      })
+}).catch((error) => console.log(error))

package/src/npmrc.ts

@@ -0,0 +1,41 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+
+import { parse } from 'ini'
+
+function replaceEnvironmentVariable(token: string): string {
+  return token.replace(/^\$\{?([^}]*)\}?$/, (_match, ...vars: any[]) => {
+    return process.env[vars[0]] || ''
+  })
+}
+
+async function readFile(filename: string): Promise<Record<string, any>> {
+  try {
+    const data = await fs.readFile(filename, 'utf8')
+    const npmrc = parse(data)
+
+    for (const key in npmrc) {
+      if (typeof npmrc[key] === 'string') {
+        npmrc[key] = replaceEnvironmentVariable(npmrc[key])
+      }
+    }
+
+    return npmrc
+  } catch (error: any) {
+    if (error.code === 'ENOENT') return {}
+    throw error
+  }
+}
+
+export async function readNpmRc(packageJsonFile: string): Promise<Record<string, any>> {
+  const local = readFile(path.resolve(packageJsonFile, '..', '.npmrc'))
+  const user = readFile(
+    process.env.NPM_CONFIG_USERCONFIG ?
+      process.env.NPM_CONFIG_USERCONFIG :
+      process.env.HOME ? path.resolve(process.env.HOME, '.npmrc') : '' )
+  const global = readFile(
+    process.env.NPM_CONFIG_GLOBALCONFIG ?
+      process.env.NPM_CONFIG_GLOBALCONFIG :
+      '/etc/npmrc')
+  return Object.assign({}, ...await Promise.all([ global, user, local ]))
+}

package/src/updater.ts

@@ -0,0 +1,210 @@
+import fs from 'node:fs/promises'
+
+import glob from 'glob'
+import semver from 'semver'
+import fetch from 'npm-registry-fetch'
+
+import { readNpmRc } from './npmrc'
+
+import type { ReleaseType } from 'semver'
+
+export type UpdaterOptions = {
+  bump?: ReleaseType,
+  strict?: boolean,
+  quick?: boolean,
+  debug?: boolean,
+  dryrun?: boolean,
+}
+
+interface Change {
+  name: string,
+  from: string,
+  to: string,
+  kind: string,
+}
+
+/* Our packages cache version */
+const cache: Record<string, Promise<string[]>> = {}
+
+/* Destructuring from "fs.promises" */
+const { readFile, writeFile } = fs
+
+/* Colors */
+const [ K, R, G, Y, B ] = [ 0, 31, 32, 33, 34 ].map((x) => `\u001b[${x}m`)
+
+/* ========================================================================== *
+ * Process a number of package files one by one                               *
+ * ========================================================================== */
+export async function processPackages(
+    patterns: string | string[],
+    options: UpdaterOptions,
+): Promise<number> {
+  /* Destructure our options */
+  const { bump, quick, strict, debug, dryrun } = options
+
+  /* ------------------------------------------------------------------------ *
+   * A super-simple debug function                                            *
+   * ------------------------------------------------------------------------ */
+  function $debug(...args: string[]): void {
+    if (debug && args) console.log(`${R}[DEBUG]${K}`, ...args)
+  }
+
+  /* ------------------------------------------------------------------------ *
+   * Download (or return cached) versions for a package, greatest first       *
+   * (we're upgrading, ainnit?) without any prerelease                        *
+   * ------------------------------------------------------------------------ */
+
+  function getVersions(name: string, npmrc: Record<string, any>): Promise<string[]> {
+    if (name in cache) {
+      $debug(`Returning cached versions for ${Y}${name}${K}`)
+      return cache[name]
+    }
+
+    $debug(`Retrieving versions for package ${Y}${name}${K}`)
+
+    const range = new semver.Range('>=0.0.0', { includePrerelease: false })
+
+    return cache[name] = fetch.json(name, Object.assign({}, npmrc, { spec: name }))
+        .then((data: any) => {
+          return Object.entries(data.versions as Record<string, Record<string, any>>)
+              .filter(([ , info ]) => ! info.deprecated) // no deprecated
+              .map(([ version ]) => version) // extract key (version)
+              .filter((version) => range.test(version)) // range match
+              .sort(semver.rcompare)
+        })
+  }
+
+  /* ------------------------------------------------------------------------ *
+   * Update the version for a single dependency                               *
+   * ------------------------------------------------------------------------ */
+  async function updateDependency(name: string, rangeString: string, npmrc: Record<string, any>): Promise<string> {
+    const match = /^\s*([~^])\s*(\d+(\.\d+(\.\d+)?)?)\s*$/.exec(rangeString)
+    if (! match) {
+      $debug(`Not processing range ${G}${rangeString}${K} for ${Y}${name}${K}`)
+      return rangeString
+    }
+
+    const [ , specifier, version ] = match
+
+    if (! strict) {
+      const r = rangeString
+      rangeString = `>=${version}`
+      if (specifier === '~') rangeString += ` <${semver.inc(version, 'major')}`
+      $debug(`Extending version for ${Y}${name}${K} from ${G}${r}${K} to ${G}${rangeString}${K}`)
+    }
+
+    const range = new semver.Range(rangeString)
+    const versions = await getVersions(name, npmrc)
+
+    for (const v of versions) {
+      if (range.test(v)) return `${specifier}${v}`
+    }
+    return `${specifier}${version}`
+  }
+
+  /* ------------------------------------------------------------------------ *
+   * Process all dependencies in a package file                               *
+   * ------------------------------------------------------------------------ */
+  async function processPackage(file: string): Promise<number> {
+    process.stdout.write(`Processing ${G}${file}${K} `)
+
+    const data = JSON.parse(await readFile(file, 'utf8'))
+    if (data.name) {
+      process.stdout.write(`[${Y}${data.name}`)
+      if (data.version) process.stdout.write(` ${data.version}`)
+      process.stdout.write(`${K}] `)
+    }
+    if (debug) process.stdout.write('\n')
+
+    const npmrc = await readNpmRc(file)
+
+    const changes: Change[] = []
+    let mainDependencyChanges = 0
+
+    for (const type in data) {
+      if (! type.match(/[dD]ependencies$/)) continue
+      if (type.match(/bundled?Dependencies/)) continue
+
+      const kind = type.length > 12 ? ` [${type.slice(0, -12)}]` : ''
+
+      const dependencies: Record<string, string> = {}
+      const promises = Object.keys(data[type] || {}).sort().map(async (name) => {
+        const from: string = data[type][name]
+        const to = await updateDependency(name, from, npmrc)
+        if (! debug) process.stdout.write('.')
+        if (from !== to) {
+          changes.push({ name, from, to, kind })
+          if (type === 'dependencies') mainDependencyChanges ++
+        }
+        dependencies[name] = to
+      })
+
+      await Promise.all(promises)
+
+      if (Object.keys(dependencies).length) {
+        data[type] = dependencies
+      } else {
+        delete data[type]
+      }
+    }
+
+    if (debug) process.stdout.write('Updated with')
+
+    if (! changes.length) {
+      console.log(` ${R}no changes${K}`)
+      return 0
+    }
+
+    /* Really pretty print */
+    changes.sort(({ name: a }, { name: b }) => a < b ? -1 : a > b ? 1 : 0)
+    console.log(` ${R}${changes.length} changes${K}`)
+    let lname = 0; let lfrom = 0; let lto = 0
+    for (const { name, from, to } of changes) {
+      lname = lname > name.length ? lname : name.length
+      lfrom = lfrom > from.length ? lfrom : from.length
+      lto = lto > to.length ? lto : to.length
+    }
+
+    for (const { name, from, to, kind } of changes) {
+      console.log(` * ${Y}${name.padEnd(lname)}${K}  :  ${G}${from.padStart(lfrom)}${K} -> ${G}${to.padEnd(lto)} ${B}${kind}${K}`)
+    }
+
+    /* Ignore all changes if no main changes, and in "quick" mode */
+    if (quick && (mainDependencyChanges === 0)) {
+      console.log(`No changes to main dependencies, ${Y}ignoring ${changes.length} other changes${K}`)
+      return 0
+    }
+
+    /* Bump the package if we need to */
+    if (bump) {
+      const bumped = semver.inc(data.version, bump)
+      console.log(` - Bumping version ${Y}${data.version}${K} -> ${G}${bumped}${K}`)
+      data.version = bumped
+    }
+
+    /* Write out the new package file */
+    if (dryrun) {
+      console.log(`Dry run, not writing ${G}${file}${K}`)
+      return 0
+    } else {
+      await writeFile(file, JSON.stringify(data, null, 2) + '\n')
+      return changes.length
+    }
+  }
+
+  /* ------------------------------------------------------------------------ *
+   * Process a number of package files one by one                             *
+   * ------------------------------------------------------------------------ */
+  const files = await glob(patterns)
+  let changes = 0
+
+  let newline = false
+  for (const file of files) {
+    if (newline) console.log()
+    const packageChanges = await processPackage(file)
+    newline = !! packageChanges
+    changes += packageChanges
+  }
+
+  return changes
+}