@pnpm/deps.inspection.outdated 1001.1.1

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# @pnpm/outdated
+
+> Check for outdated packages
+
+<!--@shields('npm')-->
+[![npm version](https://img.shields.io/npm/v/@pnpm/outdated.svg)](https://www.npmjs.com/package/@pnpm/outdated)
+<!--/@-->
+
+## Installation
+
+```sh
+pnpm add @pnpm/outdated
+```
+
+## License
+
+[MIT](LICENSE)

package/lib/createManifestGetter.d.ts

@@ -0,0 +1,20 @@
+import { type ClientOptions, type ResolveFunction } from '@pnpm/installing.client';
+import type { DependencyManifest, PackageVersionPolicy } from '@pnpm/types';
+interface GetManifestOpts {
+    dir: string;
+    lockfileDir: string;
+    rawConfig: object;
+    minimumReleaseAge?: number;
+    minimumReleaseAgeExclude?: string[];
+}
+export type ManifestGetterOptions = Omit<ClientOptions, 'authConfig' | 'minimumReleaseAgeExclude' | 'storeIndex'> & GetManifestOpts & {
+    fullMetadata: boolean;
+    rawConfig: Record<string, string>;
+};
+export declare function createManifestGetter(opts: ManifestGetterOptions): (packageName: string, bareSpecifier: string) => Promise<DependencyManifest | null>;
+export declare function getManifest(opts: GetManifestOpts & {
+    resolve: ResolveFunction;
+    publishedBy?: Date;
+    publishedByExclude?: PackageVersionPolicy;
+}, packageName: string, bareSpecifier: string): Promise<DependencyManifest | null>;
+export {};

package/lib/createManifestGetter.js

@@ -0,0 +1,48 @@
+import { createPackageVersionPolicy } from '@pnpm/config.version-policy';
+import { createResolver, } from '@pnpm/installing.client';
+export function createManifestGetter(opts) {
+    const publishedByExclude = opts.minimumReleaseAgeExclude
+        ? createPackageVersionPolicy(opts.minimumReleaseAgeExclude)
+        : undefined;
+    const { resolve } = createResolver({
+        ...opts,
+        authConfig: opts.rawConfig,
+        filterMetadata: false, // We need all the data from metadata for "outdated --long" to work.
+        strictPublishedByCheck: Boolean(opts.minimumReleaseAge),
+    });
+    const publishedBy = opts.minimumReleaseAge
+        ? new Date(Date.now() - opts.minimumReleaseAge * 60 * 1000)
+        : undefined;
+    return getManifest.bind(null, {
+        ...opts,
+        resolve,
+        publishedBy,
+        publishedByExclude,
+    });
+}
+export async function getManifest(opts, packageName, bareSpecifier) {
+    try {
+        const resolution = await opts.resolve({ alias: packageName, bareSpecifier }, {
+            lockfileDir: opts.lockfileDir,
+            preferredVersions: {},
+            projectDir: opts.dir,
+            publishedBy: opts.publishedBy,
+            publishedByExclude: opts.publishedByExclude,
+        });
+        return resolution?.manifest ?? null;
+    }
+    catch (err) {
+        const code = err.code;
+        if (opts.publishedBy && (code === 'ERR_PNPM_NO_MATURE_MATCHING_VERSION' ||
+            code === 'ERR_PNPM_NO_MATCHING_VERSION')) {
+            // No versions found that meet the minimumReleaseAge requirement.
+            // This can happen when all published versions (including the one the
+            // "latest" dist-tag points to) are newer than the minimumReleaseAge
+            // threshold, causing the resolver to throw NO_MATCHING_VERSION instead
+            // of NO_MATURE_MATCHING_VERSION.
+            return null;
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=createManifestGetter.js.map

package/lib/index.d.ts

@@ -0,0 +1,2 @@
+export type { OutdatedPackage } from './outdated.js';
+export { outdatedDepsOfProjects } from './outdatedDepsOfProjects.js';

package/lib/index.js

@@ -0,0 +1,2 @@
+export { outdatedDepsOfProjects } from './outdatedDepsOfProjects.js';
+//# sourceMappingURL=index.js.map

package/lib/outdated.d.ts

@@ -0,0 +1,30 @@
+import type { Catalogs } from '@pnpm/catalogs.types';
+import { type LockfileObject } from '@pnpm/lockfile.fs';
+import { type DependenciesField, type IncludedDependencies, type PackageManifest, type ProjectManifest, type Registries } from '@pnpm/types';
+export * from './createManifestGetter.js';
+export type GetLatestManifestFunction = (packageName: string, rangeOrTag: string) => Promise<PackageManifest | null>;
+export interface OutdatedPackage {
+    alias: string;
+    belongsTo: DependenciesField;
+    current?: string;
+    latestManifest?: PackageManifest;
+    packageName: string;
+    wanted: string;
+    workspace?: string;
+}
+export declare function outdated(opts: {
+    catalogs?: Catalogs;
+    compatible?: boolean;
+    currentLockfile: LockfileObject | null;
+    getLatestManifest: GetLatestManifestFunction;
+    ignoreDependencies?: string[];
+    include?: IncludedDependencies;
+    lockfileDir: string;
+    manifest: ProjectManifest;
+    match?: (dependencyName: string) => boolean;
+    minimumReleaseAge?: number;
+    minimumReleaseAgeExclude?: string[];
+    prefix: string;
+    registries: Registries;
+    wantedLockfile: LockfileObject | null;
+}): Promise<OutdatedPackage[]>;

package/lib/outdated.js

@@ -0,0 +1,135 @@
+import { matchCatalogResolveResult, resolveFromCatalog, } from '@pnpm/catalogs.resolver';
+import { createMatcher } from '@pnpm/config.matcher';
+import { parseOverrides } from '@pnpm/config.parse-overrides';
+import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package';
+import { LOCKFILE_VERSION, WANTED_LOCKFILE } from '@pnpm/constants';
+import * as dp from '@pnpm/deps.path';
+import { PnpmError } from '@pnpm/error';
+import { createReadPackageHook } from '@pnpm/hooks.read-package-hook';
+import { getLockfileImporterId, } from '@pnpm/lockfile.fs';
+import { nameVerFromPkgSnapshot } from '@pnpm/lockfile.utils';
+import { getAllDependenciesFromManifest } from '@pnpm/pkg-manifest.utils';
+import { parseBareSpecifier } from '@pnpm/resolving.npm-resolver';
+import { DEPENDENCIES_FIELDS, } from '@pnpm/types';
+import semver from 'semver';
+export * from './createManifestGetter.js';
+export async function outdated(opts) {
+    if (packageHasNoDeps(opts.manifest))
+        return [];
+    if (opts.wantedLockfile == null) {
+        throw new PnpmError('OUTDATED_NO_LOCKFILE', `No lockfile in directory "${opts.lockfileDir}". Run \`pnpm install\` to generate one.`);
+    }
+    async function getOverriddenManifest() {
+        const overrides = opts.currentLockfile?.overrides ?? opts.wantedLockfile?.overrides;
+        if (overrides) {
+            const readPackageHook = createReadPackageHook({
+                lockfileDir: opts.lockfileDir,
+                overrides: parseOverrides(overrides, opts.catalogs ?? {}),
+            });
+            const manifest = await readPackageHook?.(opts.manifest, opts.lockfileDir);
+            if (manifest)
+                return manifest;
+        }
+        return opts.manifest;
+    }
+    const allDeps = getAllDependenciesFromManifest(await getOverriddenManifest());
+    const importerId = getLockfileImporterId(opts.lockfileDir, opts.prefix);
+    const currentLockfile = opts.currentLockfile ?? { lockfileVersion: LOCKFILE_VERSION, importers: { [importerId]: { specifiers: {} } } };
+    const outdated = [];
+    const ignoreDependenciesMatcher = opts.ignoreDependencies?.length ? createMatcher(opts.ignoreDependencies) : undefined;
+    await Promise.all(DEPENDENCIES_FIELDS.map(async (depType) => {
+        if (opts.include?.[depType] === false ||
+            (opts.wantedLockfile.importers[importerId][depType] == null))
+            return;
+        let pkgs = Object.keys(opts.wantedLockfile.importers[importerId][depType]);
+        if (opts.match != null) {
+            pkgs = pkgs.filter((pkgName) => opts.match(pkgName));
+        }
+        const _replaceCatalogProtocolIfNecessary = replaceCatalogProtocolIfNecessary.bind(null, opts.catalogs ?? {});
+        await Promise.all(pkgs.map(async (alias) => {
+            if (!allDeps[alias])
+                return;
+            const ref = opts.wantedLockfile.importers[importerId][depType][alias];
+            if (ref.startsWith('file:') || // ignoring linked packages. (For backward compatibility)
+                ignoreDependenciesMatcher?.(alias)) {
+                return;
+            }
+            const relativeDepPath = dp.refToRelative(ref, alias);
+            // ignoring linked packages
+            if (relativeDepPath === null)
+                return;
+            const pkgSnapshot = opts.wantedLockfile.packages?.[relativeDepPath];
+            if (pkgSnapshot == null) {
+                throw new Error(`Invalid ${WANTED_LOCKFILE} file. ${relativeDepPath} not found in packages field`);
+            }
+            const currentRef = currentLockfile.importers[importerId]?.[depType]?.[alias];
+            const currentRelative = currentRef && dp.refToRelative(currentRef, alias);
+            const current = (currentRelative && dp.parse(currentRelative).version) ?? currentRef;
+            const wanted = dp.parse(relativeDepPath).version ?? ref;
+            const { name: packageName } = nameVerFromPkgSnapshot(relativeDepPath, pkgSnapshot);
+            const name = dp.parse(relativeDepPath).name ?? packageName;
+            const bareSpecifier = _replaceCatalogProtocolIfNecessary({ alias, bareSpecifier: allDeps[alias] });
+            // If the npm resolve parser cannot parse the spec of the dependency,
+            // it means that the package is not from a npm-compatible registry.
+            // In that case, we can't check whether the package is up-to-date
+            if (parseBareSpecifier(bareSpecifier, alias, 'latest', pickRegistryForPackage(opts.registries, name)) == null) {
+                if (current !== wanted) {
+                    outdated.push({
+                        alias,
+                        belongsTo: depType,
+                        current,
+                        latestManifest: undefined,
+                        packageName,
+                        wanted,
+                        workspace: opts.manifest.name,
+                    });
+                }
+                return;
+            }
+            const latestManifest = await opts.getLatestManifest(name, opts.compatible ? (bareSpecifier ?? 'latest') : 'latest');
+            if (latestManifest == null)
+                return;
+            if (!current) {
+                outdated.push({
+                    alias,
+                    belongsTo: depType,
+                    latestManifest,
+                    packageName,
+                    wanted,
+                    workspace: opts.manifest.name,
+                });
+                return;
+            }
+            if (current !== wanted || semver.lt(current, latestManifest.version) || latestManifest.deprecated) {
+                outdated.push({
+                    alias,
+                    belongsTo: depType,
+                    current,
+                    latestManifest,
+                    packageName,
+                    wanted,
+                    workspace: opts.manifest.name,
+                });
+            }
+        }));
+    }));
+    return outdated.sort((pkg1, pkg2) => pkg1.packageName.localeCompare(pkg2.packageName));
+}
+function packageHasNoDeps(manifest) {
+    return ((manifest.dependencies == null) || isEmpty(manifest.dependencies)) &&
+        ((manifest.devDependencies == null) || isEmpty(manifest.devDependencies)) &&
+        ((manifest.optionalDependencies == null) || isEmpty(manifest.optionalDependencies));
+}
+function isEmpty(obj) {
+    return Object.keys(obj).length === 0;
+}
+function replaceCatalogProtocolIfNecessary(catalogs, wantedDependency) {
+    return matchCatalogResolveResult(resolveFromCatalog(catalogs, wantedDependency), {
+        unused: () => wantedDependency.bareSpecifier,
+        found: (found) => found.resolution.specifier,
+        misconfiguration: (misconfiguration) => {
+            throw misconfiguration.error;
+        },
+    });
+}
+//# sourceMappingURL=outdated.js.map

package/lib/outdatedDepsOfProjects.d.ts

@@ -0,0 +1,15 @@
+import type { Catalogs } from '@pnpm/catalogs.types';
+import type { IncludedDependencies, ProjectManifest, ProjectRootDir } from '@pnpm/types';
+import { type ManifestGetterOptions } from './createManifestGetter.js';
+import { type OutdatedPackage } from './outdated.js';
+export declare function outdatedDepsOfProjects(pkgs: Array<{
+    rootDir: ProjectRootDir;
+    manifest: ProjectManifest;
+}>, args: string[], opts: Omit<ManifestGetterOptions, 'fullMetadata' | 'lockfileDir'> & {
+    catalogs?: Catalogs;
+    compatible?: boolean;
+    ignoreDependencies?: string[];
+    include: IncludedDependencies;
+    minimumReleaseAge?: number;
+    minimumReleaseAgeExclude?: string[];
+} & Partial<Pick<ManifestGetterOptions, 'fullMetadata' | 'lockfileDir'>>): Promise<OutdatedPackage[][]>;

package/lib/outdatedDepsOfProjects.js

@@ -0,0 +1,42 @@
+import path from 'node:path';
+import { createMatcher } from '@pnpm/config.matcher';
+import { readCurrentLockfile, readWantedLockfile, } from '@pnpm/lockfile.fs';
+import { unnest } from 'ramda';
+import { createManifestGetter } from './createManifestGetter.js';
+import { outdated } from './outdated.js';
+export async function outdatedDepsOfProjects(pkgs, args, opts) {
+    if (!opts.lockfileDir) {
+        return unnest(await Promise.all(pkgs.map(async (pkg) => outdatedDepsOfProjects([pkg], args, { ...opts, lockfileDir: pkg.rootDir }))));
+    }
+    const lockfileDir = opts.lockfileDir ?? opts.dir;
+    const internalPnpmDir = path.join(path.join(lockfileDir, 'node_modules/.pnpm'));
+    const currentLockfile = await readCurrentLockfile(internalPnpmDir, { ignoreIncompatible: false });
+    const wantedLockfile = await readWantedLockfile(lockfileDir, { ignoreIncompatible: false }) ?? currentLockfile;
+    const getLatestManifest = createManifestGetter({
+        ...opts,
+        fullMetadata: opts.fullMetadata === true || Boolean(opts.minimumReleaseAge),
+        lockfileDir,
+        minimumReleaseAge: opts.minimumReleaseAge,
+        minimumReleaseAgeExclude: opts.minimumReleaseAgeExclude,
+    });
+    return Promise.all(pkgs.map(async ({ rootDir, manifest }) => {
+        const match = (args.length > 0) && createMatcher(args) || undefined;
+        return outdated({
+            catalogs: opts.catalogs,
+            compatible: opts.compatible,
+            currentLockfile,
+            getLatestManifest,
+            ignoreDependencies: opts.ignoreDependencies,
+            include: opts.include,
+            lockfileDir,
+            manifest,
+            match,
+            minimumReleaseAge: opts.minimumReleaseAge,
+            minimumReleaseAgeExclude: opts.minimumReleaseAgeExclude,
+            prefix: rootDir,
+            registries: opts.registries,
+            wantedLockfile,
+        });
+    }));
+}
+//# sourceMappingURL=outdatedDepsOfProjects.js.map

package/package.json

@@ -0,0 +1,70 @@
+{
+  "name": "@pnpm/deps.inspection.outdated",
+  "version": "1001.1.1",
+  "description": "Check for outdated packages",
+  "keywords": [
+    "pnpm",
+    "pnpm11",
+    "outdated"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": "https://github.com/pnpm/pnpm/tree/main/deps/inspection/outdated",
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/deps/inspection/outdated#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "dependencies": {
+    "ramda": "npm:@pnpm/ramda@0.28.1",
+    "semver": "^7.7.2",
+    "@pnpm/config.parse-overrides": "1001.0.3",
+    "@pnpm/catalogs.types": "1000.0.0",
+    "@pnpm/config.pick-registry-for-package": "1000.0.11",
+    "@pnpm/config.matcher": "1000.1.0",
+    "@pnpm/config.version-policy": "1000.0.0",
+    "@pnpm/constants": "1001.3.1",
+    "@pnpm/deps.path": "1001.1.3",
+    "@pnpm/error": "1000.0.5",
+    "@pnpm/catalogs.resolver": "1000.0.5",
+    "@pnpm/installing.client": "1001.1.4",
+    "@pnpm/hooks.read-package-hook": "1000.0.15",
+    "@pnpm/lockfile.fs": "1001.1.21",
+    "@pnpm/lockfile.utils": "1003.0.3",
+    "@pnpm/resolving.npm-resolver": "1004.4.1",
+    "@pnpm/types": "1000.9.0",
+    "@pnpm/pkg-manifest.utils": "1001.0.6"
+  },
+  "peerDependencies": {
+    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
+  },
+  "devDependencies": {
+    "@jest/globals": "30.0.5",
+    "@types/ramda": "0.29.12",
+    "@types/semver": "7.7.1",
+    "@pnpm/logger": "1001.0.1",
+    "@pnpm/resolving.resolver-base": "1005.1.0",
+    "@pnpm/deps.inspection.outdated": "1001.1.1"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config/with-registry"
+  },
+  "scripts": {
+    "test": "pnpm run compile && pnpm run _test",
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
+    "compile": "tsgo --build && pnpm run lint --fix"
+  }
+}