inup 1.5.5 → 1.6.0

package/README.md

@@ -49,23 +49,66 @@ inup [options]
 -i, --ignore <packages>       Ignore packages (comma-separated, glob supported)
 --max-depth <number>          Maximum scan depth for package discovery (default: 10)
 --package-manager <name>      Force package manager (npm, yarn, pnpm, bun)
+--json                        Print a machine-readable JSON report and exit (read-only)
+-c, --check                   Exit non-zero if updates exist, without writing (for CI)
 --debug                       Write verbose debug logs
 ```
 
+## CI & Scripting
+
+`inup` runs headless automatically when stdout isn't a TTY or `$CI` is set, so it never hangs in a
+pipeline waiting on the interactive UI. Both `--json` and `--check` are **read-only** — they report,
+they never edit `package.json` or install.
+
+```bash
+inup --check            # exit 1 if anything is outdated → fails the build
+inup --json | jq        # structured drift report for dashboards/bots
+inup | cat              # plain line-based report when piped to a log
+```
+
+Each reported package carries its health signals: `deprecated` (npm deprecation message), `enginesNode`
+(declared `engines.node`), and `vulnerability` (known advisories on the currently-installed version,
+from one bulk `npm audit`-style request). Every advisory is **cross-referenced against the upgrade
+targets**, so you know whether the upgrade actually fixes it:
+
+- `vulnerability.advisories[].fixedByRange` / `fixedByLatest` — does the in-range / latest target escape
+  this advisory's affected range?
+- `vulnerability.fixedByRange` / `fixedByLatest` — does the target clear **every** advisory?
+
+The summary includes a `vulnerable` count, and the payload carries a `schemaVersion` so scripts and
+agents can pin to a known shape.
+
+Output hygiene: with `--json`, stdout carries **only** the JSON document; all progress and warnings go
+to stderr. Exit codes: `0` up to date, `1` updates exist (`--check`), `2` error.
+
 ## Keyboard Shortcuts
 
+<!-- KEYS:START -->
 | Key | Action |
 |-----|--------|
-| `↑` `↓` | Navigate packages |
-| `←` `→` | Select version (current, patch, minor, major) |
-| `Space` | Toggle selection |
-| `m` | Select all minor updates |
-| `l` | Select all latest updates |
-| `u` | Unselect all |
-| `/` | Search packages |
-| `i` | View package info |
-| `t` | Change theme |
-| `Enter` | Confirm and upgrade |
+| `↑ / k` | Move up |
+| `↓ / j` | Move down |
+| `g` | Jump to the first package |
+| `G` | Jump to the last package |
+| `←` | Cycle selection left (none → range → latest) |
+| `→` | Cycle selection right (none → range → latest) |
+| `Space` | Toggle the current package on/off |
+| `m` | Select all minor/patch updates |
+| `l` | Select all latest updates (including major) |
+| `u` | Unselect all packages |
+| `Enter` | Confirm selection and upgrade |
+| `/` | Search packages by name |
+| `d` | Toggle devDependencies |
+| `p` | Toggle peerDependencies |
+| `o` | Toggle optionalDependencies |
+| `s` | Run the vulnerability audit |
+| `v` | Show only vulnerable packages |
+| `Esc` | Clear the active search filter |
+| `i` | View package details and changelog |
+| `t` | Change the color theme |
+| `?` | Show this help |
+| `!` | Show the performance/debug panel |
+<!-- KEYS:END -->
 
 ## Privacy
 

package/dist/cli.js

@@ -7,27 +7,34 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCli = runCli;
 const commander_1 = require("commander");
 const chalk_1 = __importDefault(require("chalk"));
-const fs_1 = require("fs");
 const path_1 = require("path");
 const index_1 = require("./index");
+const headless_1 = require("./features/headless");
 const services_1 = require("./services");
 const config_1 = require("./config");
 const utils_1 = require("./utils");
 const git_1 = require("./utils/git");
-const terminal_input_1 = require("./ui/utils/terminal-input");
-const packageJson = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '../package.json'), 'utf-8'));
+const ui_1 = require("./ui");
 const program = new commander_1.Command();
 async function runCli(options) {
+    // Resolve colored-output intent before anything renders.
+    (0, utils_1.applyColorSetting)(options.color);
     const cwd = (0, path_1.resolve)(options.dir);
     if (options.debug || process.env.INUP_DEBUG === '1') {
         (0, utils_1.enableDebugLogging)();
     }
-    const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
-    if (gitState.isRepo && gitState.isDirty) {
-        const shouldProceed = await terminal_input_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
-        if (!shouldProceed) {
-            console.log(chalk_1.default.yellow('Upgrade cancelled.'));
-            return;
+    // Headless when piped, in CI, or when a non-interactive flag is set. The TUI only renders in
+    // interactive mode; everything else routes through the read-only headless report path.
+    const interactive = !!process.stdout.isTTY && !process.env.CI && !options.json && !options.check;
+    // The dirty-tree prompt would hang without a TTY; headless is read-only anyway, so skip it.
+    if (interactive) {
+        const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
+        if (gitState.isRepo && gitState.isDirty) {
+            const shouldProceed = await ui_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
+            if (!shouldProceed) {
+                console.log(chalk_1.default.yellow('Upgrade cancelled.'));
+                return;
+            }
         }
     }
     // Load project config from .inuprc
@@ -54,8 +61,11 @@ async function runCli(options) {
         console.error(chalk_1.default.yellow('Expected a non-negative integer, for example: --max-depth 10'));
         process.exit(1);
     }
-    // Check for updates in the background (non-blocking)
-    const updateCheckPromise = (0, services_1.checkForUpdateAsync)('inup', packageJson.version);
+    // Check for updates in the background (non-blocking). Interactive only — keeps headless stdout
+    // clean and avoids a lingering fetch handle in CI.
+    const updateCheckPromise = interactive
+        ? (0, services_1.checkForUpdateAsync)(config_1.PACKAGE_NAME, config_1.PACKAGE_VERSION)
+        : undefined;
     // Validate package manager if provided
     let packageManager;
     if (options.packageManager) {
@@ -67,50 +77,62 @@ async function runCli(options) {
         }
         packageManager = options.packageManager;
     }
-    const upgrader = new index_1.UpgradeRunner({
+    const runnerOptions = {
         cwd,
         excludePatterns,
+        scanDirs: projectConfig.scanDirs,
         maxDepth,
         ignorePackages,
         packageManager,
         showPeerDependencyVulnerabilities: projectConfig.showPeerDependencyVulnerabilities ?? false,
         showOptionalDependencyVulnerabilities: projectConfig.showOptionalDependencyVulnerabilities ?? false,
         debug: options.debug || process.env.INUP_DEBUG === '1',
-    });
-    await upgrader.run();
+        saveExact: options.saveExact ?? false,
+    };
+    // Non-interactive (piped / CI / --json / --check) routes to the read-only headless feature;
+    // only the interactive path builds the full TUI runner.
+    if (!interactive) {
+        await new headless_1.HeadlessRunner(runnerOptions).run({ json: options.json, check: options.check });
+        return;
+    }
+    await new index_1.UpgradeRunner(runnerOptions).run();
     // After the main flow completes, check if there's an update available
     const updateCheck = await updateCheckPromise;
     if (updateCheck?.isOutdated) {
-        console.log('');
-        console.log(chalk_1.default.yellow('┌' + '─'.repeat(78) + '┐'));
-        console.log(chalk_1.default.yellow('│') +
-            ' ' +
+        const columns = process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
+        const innerWidth = Math.max(40, Math.min(columns, 100) - 2); // chars between the │ borders
+        const border = chalk_1.default.yellow;
+        const padTo = (visibleLength) => ' '.repeat(Math.max(0, innerWidth - visibleLength));
+        const line1Plain = ` Update available! ${updateCheck.currentVersion} → ${updateCheck.latestVersion}`;
+        const line1 = ' ' +
             chalk_1.default.bold.yellow('Update available! ') +
-            chalk_1.default.gray(`${updateCheck.currentVersion}`) +
+            chalk_1.default.gray(updateCheck.currentVersion) +
             ' → ' +
-            chalk_1.default.green(`${updateCheck.latestVersion}`) +
-            ' '.repeat(78 - 19 - updateCheck.currentVersion.length - 3 - updateCheck.latestVersion.length - 1) +
-            chalk_1.default.yellow('│'));
-        console.log(chalk_1.default.yellow('│') +
-            ' ' +
-            chalk_1.default.gray('Run: ') +
-            chalk_1.default.cyan(updateCheck.updateCommand) +
-            ' '.repeat(78 - 6 - updateCheck.updateCommand.length - 1) +
-            chalk_1.default.yellow('│'));
-        console.log(chalk_1.default.yellow('└' + '─'.repeat(78) + '┘'));
+            chalk_1.default.green(updateCheck.latestVersion);
+        const line2Plain = ` Run: ${updateCheck.updateCommand}`;
+        const line2 = ' ' + chalk_1.default.gray('Run: ') + chalk_1.default.cyan(updateCheck.updateCommand);
+        console.log('');
+        console.log(border('┌' + '─'.repeat(innerWidth) + '┐'));
+        console.log(border('│') + line1 + padTo(line1Plain.length) + border('│'));
+        console.log(border('│') + line2 + padTo(line2Plain.length) + border('│'));
+        console.log(border('└' + '─'.repeat(innerWidth) + '┘'));
         console.log('');
     }
 }
 program
-    .name('inup')
+    .name(config_1.PACKAGE_NAME)
     .description('Interactive upgrade tool for package managers. Auto-detects and works with npm, yarn, pnpm, and bun.')
-    .version(packageJson.version)
+    .version(config_1.PACKAGE_VERSION)
     .option('-d, --dir <directory>', 'specify directory to run in', process.cwd())
     .option('-e, --exclude <patterns>', 'exclude paths matching regex patterns (comma-separated)', '')
     .option('-i, --ignore <packages>', 'ignore packages (comma-separated, supports glob patterns like @babel/*)')
     .option('--max-depth <number>', 'maximum directory depth for package.json discovery', '10')
     .option('--package-manager <name>', 'manually specify package manager (npm, yarn, pnpm, bun)')
     .option('--debug', 'write verbose debug log to /tmp/inup-debug-YYYY-MM-DD.log')
+    .option('--no-color', 'disable colored output (also respects NO_COLOR / FORCE_COLOR)')
+    .option('--save-exact', 'write exact versions instead of preserving the range prefix (^/~)')
+    .option('--json', 'print a machine-readable JSON report and exit (non-interactive, read-only)')
+    .option('-c, --check', 'exit non-zero if updates exist, without writing (for CI; read-only)')
     .action(runCli);
 // Handle uncaught errors gracefully
 process.on('uncaughtException', (error) => {

package/dist/config/constants.js

@@ -1,13 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JSDELIVR_POOL_TIMEOUT = exports.JSDELIVR_RETRY_DELAYS = exports.JSDELIVR_RETRY_TIMEOUTS = exports.REQUEST_TIMEOUT = exports.CACHE_TTL = exports.MAX_CONCURRENT_REQUESTS = exports.JSDELIVR_CDN_URL = exports.NPM_REGISTRY_URL = exports.PACKAGE_NAME = void 0;
-exports.PACKAGE_NAME = 'inup';
+exports.REQUEST_TIMEOUT = exports.CACHE_TTL = exports.MAX_CONCURRENT_REQUESTS = exports.NPM_REGISTRY_URL = exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
+var package_meta_1 = require("./package-meta");
+Object.defineProperty(exports, "PACKAGE_NAME", { enumerable: true, get: function () { return package_meta_1.PACKAGE_NAME; } });
+Object.defineProperty(exports, "PACKAGE_VERSION", { enumerable: true, get: function () { return package_meta_1.PACKAGE_VERSION; } });
 exports.NPM_REGISTRY_URL = 'https://registry.npmjs.org';
-exports.JSDELIVR_CDN_URL = 'https://cdn.jsdelivr.net/npm';
 exports.MAX_CONCURRENT_REQUESTS = 150;
 exports.CACHE_TTL = 5 * 60 * 1000; // 5 minutes in milliseconds
 exports.REQUEST_TIMEOUT = 60000; // 60 seconds in milliseconds
-exports.JSDELIVR_RETRY_TIMEOUTS = [2000, 3500]; // short retry budget to keep fallback fast
-exports.JSDELIVR_RETRY_DELAYS = [150]; // tiny backoff between jsDelivr retries in ms
-exports.JSDELIVR_POOL_TIMEOUT = 60000; // keep-alive/connect lifecycle should be looser than per-request timeouts
 //# sourceMappingURL=constants.js.map

package/dist/config/package-meta.js

@@ -0,0 +1,10 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PACKAGE_VERSION = exports.PACKAGE_NAME = void 0;
+const package_json_1 = __importDefault(require("../../package.json"));
+exports.PACKAGE_NAME = package_json_1.default.name;
+exports.PACKAGE_VERSION = package_json_1.default.version;
+//# sourceMappingURL=package-meta.js.map

package/dist/config/project-config.js

@@ -4,7 +4,12 @@ exports.loadProjectConfig = loadProjectConfig;
 exports.isPackageIgnored = isPackageIgnored;
 const fs_1 = require("fs");
 const path_1 = require("path");
-const CONFIG_FILES = ['.inuprc', '.inuprc.json', 'inup.config.json'];
+const package_meta_1 = require("./package-meta");
+const CONFIG_FILES = [
+    `.${package_meta_1.PACKAGE_NAME}rc`,
+    `.${package_meta_1.PACKAGE_NAME}rc.json`,
+    `${package_meta_1.PACKAGE_NAME}.config.json`,
+];
 /**
  * Load project configuration from .inuprc, .inuprc.json, or inup.config.json
  * Searches in the specified directory and parent directories up to root
@@ -49,6 +54,11 @@ function normalizeConfig(config) {
             normalized.exclude = config.exclude.filter((item) => typeof item === 'string');
         }
     }
+    if (config.scanDirs) {
+        if (Array.isArray(config.scanDirs)) {
+            normalized.scanDirs = config.scanDirs.filter((item) => typeof item === 'string');
+        }
+    }
     if (typeof config.showPeerDependencyVulnerabilities === 'boolean') {
         normalized.showPeerDependencyVulnerabilities = config.showPeerDependencyVulnerabilities;
     }

package/dist/core/package-detector.js

@@ -32,8 +32,12 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageDetector = void 0;
+const chalk_1 = __importDefault(require("chalk"));
 const semver = __importStar(require("semver"));
 const utils_1 = require("../utils");
 const services_1 = require("../services");
@@ -42,13 +46,19 @@ const utils_2 = require("../ui/utils");
 const utils_3 = require("../utils");
 const debug_1 = require("../features/debug");
 class PackageDetector {
+    packageJsonPath = null;
+    packageJson = null;
+    cwd;
+    excludePatterns;
+    scanDirs;
+    ignorePackages;
+    maxDepth;
+    batchSize = 10;
+    maxConcurrency = 10;
     constructor(options) {
-        this.packageJsonPath = null;
-        this.packageJson = null;
-        this.batchSize = 10;
-        this.maxConcurrency = 10;
         this.cwd = options?.cwd || process.cwd();
         this.excludePatterns = options?.excludePatterns || [];
+        this.scanDirs = options?.scanDirs || [];
         this.ignorePackages = options?.ignorePackages || [];
         this.maxDepth = options?.maxDepth ?? 10;
         this.packageJsonPath = (0, utils_1.findPackageJson)(this.cwd);
@@ -278,6 +288,8 @@ class PackageDetector {
                     hasRangeUpdate,
                     hasMajorUpdate,
                     allVersions,
+                    deprecated: packageData.deprecated,
+                    enginesNode: packageData.enginesNode,
                 };
             }
             catch (error) {
@@ -309,13 +321,17 @@ class PackageDetector {
         };
     }
     async findPackageJsonFilesWithTimeout(timeoutMs) {
+        const skippedPackageDirs = new Set();
         try {
             let timeoutId;
             try {
-                return await Promise.race([
+                const files = await Promise.race([
                     (0, utils_1.findAllPackageJsonFilesAsync)(this.cwd, this.excludePatterns, this.maxDepth, (currentDir, foundCount) => {
                         const truncatedDir = currentDir.length > 50 ? '...' + currentDir.slice(-47) : currentDir;
                         this.showProgress(`🔍 Scanning ${truncatedDir} (found ${foundCount})`);
+                    }, {
+                        scanDirs: this.scanDirs,
+                        onSkippedPackageDir: (relativePath) => skippedPackageDirs.add(relativePath),
                     }),
                     new Promise((_, reject) => {
                         timeoutId = setTimeout(() => {
@@ -324,6 +340,8 @@ class PackageDetector {
                         timeoutId.unref?.();
                     }),
                 ]);
+                this.warnSkippedPackageDirs(skippedPackageDirs);
+                return files;
             }
             finally {
                 if (timeoutId) {
@@ -335,6 +353,20 @@ class PackageDetector {
             throw new Error(`Failed to scan for package.json files: ${err}. Try using --exclude patterns to skip problematic directories.`);
         }
     }
+    /**
+     * Warn (once per directory, after the scan) about package.json-bearing directories that the
+     * default skip list pruned, so the user can re-include them via `.inuprc`'s `scanDirs`.
+     * Emitted after scanning so it does not corrupt the progress spinner output.
+     */
+    warnSkippedPackageDirs(skippedPackageDirs) {
+        if (skippedPackageDirs.size === 0) {
+            return;
+        }
+        const list = Array.from(skippedPackageDirs).sort();
+        console.warn(chalk_1.default.yellow(`⚠️  Skipped ${list.length} package.json-bearing director${list.length === 1 ? 'y' : 'ies'} matching the default ignore list:\n` +
+            list.map((dir) => `   - ${dir}`).join('\n') +
+            `\n   Add the directory name(s) to "scanDirs" in .inuprc to include them.`));
+    }
     isWorkspaceReference(version) {
         return (version.includes('workspace:') ||
             version === '*' ||

package/dist/core/upgrade-runner.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PnpmUpgradeInteractive = exports.UpgradeRunner = void 0;
+exports.UpgradeRunner = void 0;
 const chalk_1 = __importDefault(require("chalk"));
 const package_detector_1 = require("./package-detector");
 const interactive_ui_1 = require("../interactive-ui");
@@ -15,8 +15,11 @@ const debug_1 = require("../features/debug");
  * Main orchestrator for the inup upgrade process
  */
 class UpgradeRunner {
+    detector;
+    ui;
+    upgrader;
+    packageManager;
     constructor(options) {
-        this.options = options;
         // Detect package manager
         const cwd = options?.cwd || process.cwd();
         if (options?.packageManager) {
@@ -29,6 +32,7 @@ class UpgradeRunner {
         this.ui = new interactive_ui_1.InteractiveUI(this.packageManager, {
             showPeerDependencyVulnerabilities: options?.showPeerDependencyVulnerabilities ?? false,
             showOptionalDependencyVulnerabilities: options?.showOptionalDependencyVulnerabilities ?? false,
+            saveExact: options?.saveExact ?? false,
         });
         this.upgrader = new upgrader_1.PackageUpgrader(this.packageManager);
     }
@@ -96,14 +100,14 @@ class UpgradeRunner {
             let selectedChoices = await selectionPromise;
             const outdatedPackages = this.detector.getOutdatedPackagesOnly(latestPackages);
             if (outdatedPackages.length === 0 && selectedChoices.length === 0) {
-                console.log(chalk_1.default.green('✅ All packages are up to date!'));
+                console.log(chalk_1.default.green('✅ Everything is up to date — no upgrades needed.'));
                 return;
             }
             // Interactive selection and confirmation loop
             let shouldProceed = false;
             while (true) {
                 if (selectedChoices.length === 0) {
-                    console.log(chalk_1.default.yellow('No packages selected. Exiting...'));
+                    console.log(chalk_1.default.yellow('Nothing selected — no changes made.'));
                     return;
                 }
                 // Validate selected choices before confirmation
@@ -184,10 +188,4 @@ class UpgradeRunner {
     }
 }
 exports.UpgradeRunner = UpgradeRunner;
-/**
- * @deprecated Use UpgradeRunner instead
- */
-class PnpmUpgradeInteractive extends UpgradeRunner {
-}
-exports.PnpmUpgradeInteractive = PnpmUpgradeInteractive;
 //# sourceMappingURL=upgrade-runner.js.map

package/dist/core/upgrader.js

@@ -11,16 +11,17 @@ const path_1 = require("path");
 const child_process_1 = require("child_process");
 const utils_1 = require("../utils");
 class PackageUpgrader {
+    packageManager;
     constructor(packageManager) {
         this.packageManager = packageManager;
     }
-    async upgradePackages(choices, packageInfos) {
+    async upgradePackages(choices, _packageInfos) {
         if (choices.length === 0) {
             console.log(chalk_1.default.yellow('No packages to upgrade.'));
             return;
         }
         // Group choices by package.json path and dependency type
-        const choicesByFileAndType = this.groupChoicesByFileAndType(choices, packageInfos);
+        const choicesByFileAndType = this.groupChoicesByFileAndType(choices);
         for (const [fileAndType, choiceList] of Object.entries(choicesByFileAndType)) {
             if (choiceList.length === 0)
                 continue;
@@ -32,9 +33,9 @@ class PackageUpgrader {
         const uniquePackages = new Set(choices.map((c) => c.name));
         console.log(chalk_1.default.green(`\n✅ Successfully upgraded ${uniquePackages.size} package(s)!`));
         // Execute package manager install after all upgrades are complete
-        await this.runInstall(choices, packageInfos);
+        await this.runInstall(choices);
     }
-    async runInstall(choices, packageInfos) {
+    async runInstall(choices) {
         if (choices.length === 0) {
             return;
         }
@@ -71,7 +72,7 @@ class PackageUpgrader {
             throw new Error(`${this.packageManager.installCommand} exited with code ${result.status}`);
         }
     }
-    groupChoicesByFileAndType(choices, _packageInfos) {
+    groupChoicesByFileAndType(choices) {
         const groups = {};
         choices.forEach((choice) => {
             const key = `${choice.packageJsonPath}|${choice.dependencyType}`;
@@ -91,11 +92,9 @@ class PackageUpgrader {
         const packageDir = packageJsonPath.replace('/package.json', '');
         const spinner = (0, nanospinner_1.createSpinner)(`Upgrading ${type} in ${packageDir}...`).start();
         try {
-            // Read the current package.json
+            // Read the current package.json — keep the raw text so we can round-trip its formatting
+            const rawContent = (0, fs_1.readFileSync)(packageJsonPath, 'utf-8');
             const packageJson = (0, utils_1.readPackageJson)(packageJsonPath);
-            // Find workspace root
-            const workspaceRoot = (0, utils_1.findWorkspaceRoot)(packageDir, this.packageManager.name);
-            const isWorkspaceRoot = packageDir === workspaceRoot;
             // Group by upgrade type (range vs latest)
             const rangeChoices = choices.filter((c) => c.upgradeType === 'range');
             const latestChoices = choices.filter((c) => c.upgradeType === 'latest');
@@ -120,9 +119,14 @@ class PackageUpgrader {
                     modified = true;
                 });
             }
-            // Write back the modified package.json
+            // Write back the modified package.json, preserving the original indentation and
+            // trailing-newline style. Skip the write entirely when nothing actually changed.
             if (modified) {
-                (0, fs_1.writeFileSync)(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
+                const format = (0, utils_1.detectJsonFormat)(rawContent);
+                const nextContent = JSON.stringify(packageJson, null, format.indent) + (format.trailingNewline ? '\n' : '');
+                if (nextContent !== rawContent) {
+                    (0, fs_1.writeFileSync)(packageJsonPath, nextContent);
+                }
             }
             spinner.success({ text: `Upgraded ${choices.length} ${type} in ${packageDir}` });
             // Show which packages were upgraded

package/dist/features/changelog/clients/github-client.js

@@ -2,12 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GitHubClient = void 0;
 const repository_ref_1 = require("../parsers/repository-ref");
+const config_1 = require("../../../config");
 const GITHUB_RELEASES_PAGE_LIMIT = 3;
 class GitHubClient {
-    constructor() {
-        this.releasesCache = new Map();
-        this.rawChangelogCache = new Map();
-    }
+    releasesCache = new Map();
+    rawChangelogCache = new Map();
     clearCache() {
         this.releasesCache.clear();
         this.rawChangelogCache.clear();
@@ -21,7 +20,7 @@ class GitHubClient {
                 method: 'GET',
                 headers: {
                     accept: 'application/vnd.github.v3+json',
-                    'user-agent': 'inup-cli',
+                    'user-agent': `${config_1.PACKAGE_NAME}-cli`,
                 },
                 signal,
             });
@@ -72,7 +71,7 @@ class GitHubClient {
                     method: 'GET',
                     headers: {
                         accept: 'application/vnd.github.v3+json',
-                        'user-agent': 'inup-cli',
+                        'user-agent': `${config_1.PACKAGE_NAME}-cli`,
                     },
                     signal,
                 });

package/dist/features/changelog/services/changelog-service.js

@@ -4,10 +4,8 @@ exports.changelogFetcher = exports.ChangelogFetcher = void 0;
 const package_metadata_service_1 = require("./package-metadata-service");
 const release_notes_service_1 = require("./release-notes-service");
 class ChangelogFetcher {
-    constructor() {
-        this.metadataService = new package_metadata_service_1.PackageMetadataService();
-        this.releaseNotesService = new release_notes_service_1.ReleaseNotesService(this.metadataService);
-    }
+    metadataService = new package_metadata_service_1.PackageMetadataService();
+    releaseNotesService = new release_notes_service_1.ReleaseNotesService(this.metadataService);
     async fetchPackageMetadata(packageName, version, signal) {
         return await this.metadataService.fetchPackageMetadata(packageName, version, signal);
     }

package/dist/features/changelog/services/package-metadata-service.js

@@ -3,13 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageMetadataService = void 0;
 const npm_registry_client_1 = require("../clients/npm-registry-client");
 const package_metadata_1 = require("../parsers/package-metadata");
-const jsdelivr_registry_1 = require("../../../services/jsdelivr-registry");
+const inflight_1 = require("../../../services/http/inflight");
 class PackageMetadataService {
-    constructor(npmRegistryClient = new npm_registry_client_1.NpmRegistryClient(), exactManifestFetcher = jsdelivr_registry_1.fetchExactPackageManifest) {
+    npmRegistryClient;
+    cache = new Map();
+    inFlight = new inflight_1.InflightMap();
+    constructor(npmRegistryClient = new npm_registry_client_1.NpmRegistryClient()) {
         this.npmRegistryClient = npmRegistryClient;
-        this.exactManifestFetcher = exactManifestFetcher;
-        this.cache = new Map();
-        this.inFlight = new Map();
     }
     clearCache() {
         this.cache.clear();
@@ -28,15 +28,7 @@ class PackageMetadataService {
         if (this.cache.has(cacheKey)) {
             return this.cache.get(cacheKey) ?? null;
         }
-        const inFlight = this.inFlight.get(cacheKey);
-        if (inFlight) {
-            return await inFlight;
-        }
-        const lookupPromise = this.fetchAndCachePackageMetadata(packageName, version, signal).finally(() => {
-            this.inFlight.delete(cacheKey);
-        });
-        this.inFlight.set(cacheKey, lookupPromise);
-        return await lookupPromise;
+        return this.inFlight.dedupe(cacheKey, () => this.fetchAndCachePackageMetadata(packageName, version, signal));
     }
     cacheMetadata(packageName, rawData) {
         const metadata = this.buildMetadata(packageName, rawData);
@@ -90,15 +82,7 @@ class PackageMetadataService {
     }
     async fetchPackageManifest(packageName, version, signal) {
         signal?.throwIfAborted();
-        const normalizedVersion = version?.trim();
-        if (normalizedVersion) {
-            const jsdelivrManifest = await this.exactManifestFetcher(packageName, normalizedVersion);
-            if (jsdelivrManifest) {
-                return jsdelivrManifest;
-            }
-        }
-        signal?.throwIfAborted();
-        return await this.npmRegistryClient.fetchPackageManifest(packageName, normalizedVersion || 'latest', signal);
+        return await this.npmRegistryClient.fetchPackageManifest(packageName, version?.trim() || 'latest', signal);
     }
     buildMetadata(packageName, rawData) {
         return (0, package_metadata_1.mapPackageManifestToMetadata)(packageName, rawData);