inup 1.6.0 → 1.6.3

package/dist/services/npm-registry.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetchPackageVersions = fetchPackageVersions;
 exports.clearPackageCache = clearPackageCache;
-exports.closeRegistryPool = closeRegistryPool;
 const undici_1 = require("undici");
 const node_zlib_1 = require("node:zlib");
 const node_util_1 = require("node:util");
@@ -13,27 +12,41 @@ const config_1 = require("../config");
 const version_1 = require("../utils/version");
 const retry_1 = require("./http/retry");
 const inflight_1 = require("./http/inflight");
+const resizable_semaphore_1 = require("./http/resizable-semaphore");
+const adaptive_controller_1 = require("./http/adaptive-controller");
+const etag_store_1 = require("./http/etag-store");
 const inFlightLookups = new inflight_1.InflightMap();
 const registryOrigin = new URL(config_1.NPM_REGISTRY_URL).origin;
 const registryPathPrefix = new URL(config_1.NPM_REGISTRY_URL).pathname.replace(/\/$/, '');
-// Few connections + many requests per connection = maximum keep-alive reuse.
-// No per-request timeouts: correctness matters more than speed for a CLI that
-// runs on demand. Slow responses are tolerated; only true errors cause retry.
+// Connection count is kept == the adaptive controller's ceiling (POOL_CONNECTIONS)
+// so the controller is never silently throttled below its chosen limit. Idle
+// keep-alive connections are cheap.
+//
+// `headersTimeout` is intentionally non-zero (unlike the rest, where we tolerate
+// slow bodies): a stalled connection that never sends headers would otherwise be
+// consumed forever and stay invisible to the completion-based adaptive
+// controller. With a headers timeout, a stall surfaces as a transient error the
+// controller can react to (and retry handles). `bodyTimeout` stays 0 — large
+// packuments legitimately stream slowly.
 const registryPool = new undici_1.Pool(registryOrigin, {
-    connections: 6,
+    connections: config_1.POOL_CONNECTIONS,
     pipelining: 1,
     keepAliveTimeout: 30_000,
     keepAliveMaxTimeout: 600_000,
-    headersTimeout: 0,
+    headersTimeout: 30_000,
     bodyTimeout: 0,
     connectTimeout: 15_000,
     allowH2: false,
 });
 const MAX_REGISTRY_ATTEMPTS = 3;
 const RETRY_BACKOFF_MS = [500, 1500, 3000];
-async function getFreshPackageData(packageName, currentVersion) {
+// Fixed concurrency used when adaptive is disabled (INUP_ADAPTIVE=0, the A/B
+// control arm). Matches the production caller (PackageDetector) so the fixed path
+// reproduces the legacy behavior exactly.
+const DEFAULT_FIXED_CONCURRENCY = 10;
+async function getFreshPackageData(packageName, currentVersion, onAttempt) {
     const cacheKey = `${packageName}@${currentVersion ?? ''}`;
-    return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistry(packageName));
+    return inFlightLookups.dedupe(cacheKey, () => fetchPackageFromRegistry(packageName, onAttempt));
 }
 const encodeRegistryPath = (packageName) => {
     const encodedName = packageName.startsWith('@')
@@ -42,20 +55,40 @@ const encodeRegistryPath = (packageName) => {
     return `${registryPathPrefix}/${encodedName}`;
 };
 async function attemptRegistryFetch(path) {
+    const startedAt = Date.now();
+    // Conditional request: if we have a stored ETag for this packument, ask the
+    // registry to validate it. Unchanged → 304 (no body) and we reuse stored data.
+    // This still hits the registry every run, so data is never served stale.
+    const cached = (0, etag_store_1.readEtag)(path);
     try {
+        const requestHeaders = {
+            accept: 'application/vnd.npm.install-v1+json',
+            'accept-encoding': 'gzip, deflate, br',
+        };
+        if (cached) {
+            requestHeaders['if-none-match'] = cached.etag;
+        }
         const { statusCode, headers, body } = await registryPool.request({
             path,
             method: 'GET',
-            headers: {
-                accept: 'application/vnd.npm.install-v1+json',
-                'accept-encoding': 'gzip, deflate, br',
-            },
-            headersTimeout: 0,
+            headers: requestHeaders,
+            headersTimeout: 30_000,
             bodyTimeout: 0,
             blocking: false,
         });
+        // Registry confirmed our cached copy is current — reuse it, skip the download.
+        if (statusCode === 304 && cached) {
+            await body.dump().catch(() => undefined);
+            return { kind: 'success', data: cached.data, latencyMs: Date.now() - startedAt };
+        }
         if (statusCode < 200 || statusCode >= 300) {
             await body.dump().catch(() => undefined);
+            if ((0, retry_1.isCongestionStatus)(statusCode)) {
+                return {
+                    kind: 'congested',
+                    retryAfterMs: (0, retry_1.parseRetryAfterMs)(headers['retry-after']),
+                };
+            }
             if ((0, retry_1.isRetryableStatus)(statusCode)) {
                 return { kind: 'retryable' };
             }
@@ -79,7 +112,18 @@ async function attemptRegistryFetch(path) {
         else {
             decoded = raw;
         }
-        return { kind: 'success', data: (0, version_1.parseVersions)(decoded.toString('utf8')) };
+        const data = (0, version_1.parseVersions)(decoded.toString('utf8'));
+        // Persist the ETag for next run's conditional request.
+        const etagHeader = headers['etag'];
+        const etag = Array.isArray(etagHeader) ? etagHeader[0] : etagHeader;
+        if (etag) {
+            (0, etag_store_1.writeEtag)(path, etag.toString(), data);
+        }
+        return {
+            kind: 'success',
+            data,
+            latencyMs: Date.now() - startedAt,
+        };
     }
     catch (error) {
         if ((0, retry_1.isTransientNetworkError)(error)) {
@@ -90,24 +134,28 @@ async function attemptRegistryFetch(path) {
         return { kind: 'transient' };
     }
 }
-async function fetchFromRegistryWithRetries(path) {
+async function fetchFromRegistryWithRetries(path, onAttempt) {
     let lastOutcome = { kind: 'transient' };
     for (let attempt = 0; attempt < MAX_REGISTRY_ATTEMPTS; attempt++) {
         const outcome = await attemptRegistryFetch(path);
+        onAttempt?.(outcome);
         if (outcome.kind === 'success' || outcome.kind === 'not-found') {
             return outcome;
         }
         lastOutcome = outcome;
         if (attempt < MAX_REGISTRY_ATTEMPTS - 1) {
-            const backoff = RETRY_BACKOFF_MS[Math.min(attempt, RETRY_BACKOFF_MS.length - 1)];
+            // Honor Retry-After on congestion; otherwise exponential backoff. These
+            // sleeps are deliberately NOT timed into the controller's latency EWMA.
+            const congestedWait = outcome.kind === 'congested' && outcome.retryAfterMs !== null ? outcome.retryAfterMs : null;
+            const backoff = congestedWait ?? RETRY_BACKOFF_MS[Math.min(attempt, RETRY_BACKOFF_MS.length - 1)];
             await (0, retry_1.sleep)(backoff);
         }
     }
     return lastOutcome;
 }
-async function fetchPackageFromRegistry(packageName) {
+async function fetchPackageFromRegistry(packageName, onAttempt) {
     const path = encodeRegistryPath(packageName);
-    const outcome = await fetchFromRegistryWithRetries(path);
+    const outcome = await fetchFromRegistryWithRetries(path, onAttempt);
     if (outcome.kind === 'success') {
         return outcome.data;
     }
@@ -119,29 +167,48 @@ async function fetchPackageFromRegistry(packageName) {
  * Fetches version data for a list of packages from the npm registry.
  *
  * Concurrency model:
- * - `maxConcurrency` is a global cap on in-flight fetches at any moment.
- *   It doesn't interact with batch size — batches exist only to group
- *   emissions for the UI.
- * - No per-request timeouts: slow responses are allowed to finish. Real
- *   network errors are retried with exponential backoff; after the retry
- *   budget is exhausted the package is reported as unavailable
- *   (`latestVersion: 'unknown'`). A result is never silently dropped due to
- *   slowness.
+ * - A single resizable semaphore caps in-flight fetches. Package names are
+ *   pulled from a work queue and dispatched as slots free up (a lazy pump),
+ *   rather than pre-sliced into fixed batches.
+ * - `adaptive` (default true) enables an AIMD controller that ramps the limit to
+ *   the ceiling on a healthy link and backs off on congestion (429/503) or
+ *   errors. With `adaptive:false` the limit is fixed at `maxConcurrency` (the A/B
+ *   control arm), reproducing the legacy fixed path.
+ * - Tiny runs (<= ceil packages) skip the controller and run at a fixed
+ *   `min(ceil, count)` so they never crawl up from the floor and lose to fixed.
+ * - No body timeout: slow responses finish. Real network errors and header
+ *   stalls are retried with backoff; after the retry budget is exhausted the
+ *   package is reported unavailable (`latestVersion: 'unknown'`).
+ * - Unchanged packuments are revalidated via ETag (304), skipping re-download.
  *
  * Callbacks:
- * - `onBatchReady` fires once a whole emission batch has resolved, in
- *   original batch order.
+ * - `onBatchReady` fires once an emission window has resolved, in original order.
+ *   Emission windows are fixed-size groupings for UI progress only; they do not
+ *   gate concurrency.
+ * - `onControlTick` (optional) reports each adaptive control decision for
+ *   instrumentation.
  */
 async function fetchPackageVersions(packageNames, options = {}) {
     const packageData = new Map();
-    if (packageNames.length === 0) {
+    const total = packageNames.length;
+    if (total === 0) {
         return packageData;
     }
-    const batchSizes = options.batchSizes && options.batchSizes.length > 0
-        ? options.batchSizes.map((size) => Math.max(1, size))
-        : [Math.max(1, options.batchSize ?? 25)];
-    const maxConcurrency = Math.max(1, options.maxConcurrency ?? 10);
-    const total = packageNames.length;
+    const adaptive = options.adaptive ?? true;
+    // `maxConcurrency` is the fixed cap used only when adaptive is off; it never
+    // caps the adaptive start (the controller smart-starts near the work size and
+    // ramps to the ceiling, which beats a low fixed start on large runs).
+    const fixedConcurrency = Math.max(1, options.maxConcurrency ?? DEFAULT_FIXED_CONCURRENCY);
+    const controller = adaptive && adaptive_controller_1.AdaptiveController.shouldControl(total)
+        ? new adaptive_controller_1.AdaptiveController(total, options.onControlTick)
+        : null;
+    const initialLimit = controller
+        ? controller.getLimit()
+        : adaptive
+            ? Math.min(config_1.POOL_CONNECTIONS, total) // too small to control: smart fixed start
+            : fixedConcurrency;
+    const semaphore = new resizable_semaphore_1.ResizableSemaphore(initialLimit);
+    // --- emission ordering (unchanged contract) ---------------------------------
     let completedCount = 0;
     const pendingEmissions = new Map();
     let nextEmitIndex = 0;
@@ -153,68 +220,110 @@ async function fetchPackageVersions(packageNames, options = {}) {
             nextEmitIndex++;
         }
     };
-    // Global semaphore: `maxConcurrency` is the total in-flight cap across
-    // all batches. Batches don't gate concurrency — only emission order.
-    let inFlight = 0;
-    const waiters = [];
-    const acquire = async () => {
-        if (inFlight < maxConcurrency) {
-            inFlight++;
-            return;
+    // Emission windows group results for UI progress only (decoupled from
+    // concurrency). Sizes come from `batchSizes` (a sequence, last value repeats)
+    // or a uniform `batchSize`. We precompute, per package index, which window it
+    // belongs to and its position within that window, so a window can flush as soon
+    // as all its items resolve — preserving original order via `flushPending`.
+    const windowSizes = options.batchSizes && options.batchSizes.length > 0
+        ? options.batchSizes.map((size) => Math.max(1, size))
+        : [Math.max(1, options.batchSize ?? 25)];
+    const windowIdByIndex = new Array(total);
+    const itemIndexByIndex = new Array(total);
+    const windowRemaining = [];
+    {
+        let cursorIndex = 0;
+        let windowId = 0;
+        while (cursorIndex < total) {
+            const size = windowSizes[Math.min(windowId, windowSizes.length - 1)];
+            const end = Math.min(cursorIndex + size, total);
+            windowRemaining[windowId] = end - cursorIndex;
+            for (let i = cursorIndex; i < end; i++) {
+                windowIdByIndex[i] = windowId;
+                itemIndexByIndex[i] = i - cursorIndex;
+            }
+            cursorIndex = end;
+            windowId++;
         }
-        await new Promise((resolve) => waiters.push(resolve));
-        inFlight++;
-    };
-    const release = () => {
-        inFlight--;
-        const next = waiters.shift();
-        if (next)
-            next();
+    }
+    const windowResults = windowRemaining.map(() => []);
+    // --- per-attempt observer ---------------------------------------------------
+    // Feeds the adaptive controller AND (optionally) reports per-package latency
+    // for diagnostics. Built per package so the timing callback knows the name.
+    const observerFor = (packageName) => {
+        if (!controller && !options.onPackageTiming)
+            return undefined;
+        return (outcome) => {
+            if (outcome.kind === 'success') {
+                controller?.record('success', outcome.latencyMs);
+                options.onPackageTiming?.(packageName, outcome.latencyMs);
+            }
+            else if (outcome.kind === 'congested') {
+                const next = controller?.record('congested');
+                if (next != null)
+                    semaphore.setLimit(next);
+            }
+            else if (outcome.kind === 'retryable') {
+                controller?.record('retryable');
+            }
+            else if (outcome.kind === 'transient') {
+                controller?.record('transient');
+            }
+        };
     };
-    const batchPromises = [];
-    let batchStart = 0;
-    let batchIndex = 0;
-    while (batchStart < packageNames.length) {
-        const batchSize = batchSizes[Math.min(batchIndex, batchSizes.length - 1)];
-        const batchNames = packageNames.slice(batchStart, batchStart + batchSize);
-        const capturedBatchIndex = batchIndex;
-        const batchResults = new Array(batchNames.length);
-        const batchPromise = Promise.all(batchNames.map(async (packageName, itemIndex) => {
-            await acquire();
-            try {
-                const data = await getFreshPackageData(packageName, options.currentVersions?.get(packageName));
-                packageData.set(packageName, data);
-                completedCount++;
-                batchResults[itemIndex] = {
-                    packageName,
-                    data,
-                    completed: completedCount,
-                    total,
-                    batchIndex: capturedBatchIndex,
-                    itemIndex,
-                };
+    // --- worker: pull from the queue until exhausted ----------------------------
+    let cursor = 0;
+    const runOne = async (index) => {
+        const packageName = packageNames[index];
+        await semaphore.acquire();
+        try {
+            const data = await getFreshPackageData(packageName, options.currentVersions?.get(packageName), observerFor(packageName));
+            packageData.set(packageName, data);
+            completedCount++;
+            const w = windowIdByIndex[index];
+            const itemIndex = itemIndexByIndex[index];
+            // Index by position (not push) so items keep their original in-window order
+            // even when they resolve out of order.
+            windowResults[w][itemIndex] = {
+                packageName,
+                data,
+                completed: completedCount,
+                total,
+                batchIndex: w,
+                itemIndex,
+            };
+            if (--windowRemaining[w] === 0) {
+                pendingEmissions.set(w, windowResults[w]);
+                flushPending();
             }
-            finally {
-                release();
+            if (controller) {
+                const next = controller.maybeTick();
+                if (next !== null)
+                    semaphore.setLimit(next);
             }
-        })).then(() => {
-            pendingEmissions.set(capturedBatchIndex, batchResults.filter(Boolean));
-            flushPending();
-        });
-        batchPromises.push(batchPromise);
-        batchStart += batchSize;
-        batchIndex++;
+        }
+        finally {
+            semaphore.release();
+        }
+    };
+    // The pump: keep enough workers running to saturate the (possibly growing)
+    // limit. We dispatch all indices as promises but each one waits on the
+    // semaphore before doing work, so the semaphore — not the dispatch loop —
+    // enforces the limit. Growing the limit lets queued acquirers through.
+    const workers = [];
+    while (cursor < total) {
+        workers.push(runOne(cursor));
+        cursor++;
     }
-    await Promise.all(batchPromises);
+    await Promise.all(workers);
     return packageData;
 }
 /**
- * Retained for backward compatibility. Registry responses are fresh-by-default.
+ * Clears the in-run in-flight dedupe map. Only meaningful within a single run
+ * (the map collapses duplicate concurrent lookups); registry data itself is
+ * never cached in memory across runs. Used by tests to isolate fetches.
  */
 function clearPackageCache() {
     inFlightLookups.clear();
 }
-async function closeRegistryPool() {
-    await registryPool.close();
-}
 //# sourceMappingURL=npm-registry.js.map

package/dist/services/package-manager-detector.js

@@ -22,6 +22,8 @@ const PACKAGE_MANAGERS = {
         lockFile: 'yarn.lock',
         workspaceFile: null, // Uses package.json workspaces field
         installCommand: 'yarn install',
+        // Yarn Berry defaults to immutable installs in CI; --no-immutable lets the lockfile update.
+        writeInstallCommand: 'yarn install --no-immutable',
         color: chalk_1.default.blue,
     },
     pnpm: {
@@ -30,6 +32,8 @@ const PACKAGE_MANAGERS = {
         lockFile: 'pnpm-lock.yaml',
         workspaceFile: 'pnpm-workspace.yaml',
         installCommand: 'pnpm install',
+        // pnpm defaults to --frozen-lockfile in CI; --no-frozen-lockfile lets the lockfile update.
+        writeInstallCommand: 'pnpm install --no-frozen-lockfile',
         color: chalk_1.default.yellow,
     },
     bun: {

package/dist/utils/debug-logger.js

@@ -5,6 +5,7 @@ exports.enableDebugLogging = enableDebugLogging;
 exports.isDebugEnabled = isDebugEnabled;
 exports.getDebugLogPath = getDebugLogPath;
 const fs_1 = require("fs");
+const os_1 = require("os");
 const path_1 = require("path");
 let _enabled = false;
 let _logFile = null;
@@ -18,7 +19,13 @@ function getLogFile() {
     if (!_logFile) {
         const d = new Date();
         const dateStr = `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
-        _logFile = (0, path_1.join)(`inup-debug-${dateStr}.log`);
+        // Write to the OS temp dir (matches the path advertised in --help), not the
+        // current working directory — a debug log must never litter the user's repo.
+        const dir = (0, path_1.join)((0, os_1.tmpdir)(), 'inup');
+        if (!(0, fs_1.existsSync)(dir)) {
+            (0, fs_1.mkdirSync)(dir, { recursive: true });
+        }
+        _logFile = (0, path_1.join)(dir, `inup-debug-${dateStr}.log`);
         // Write a header so the file is easy to identify
         (0, fs_1.writeFileSync)(_logFile, `=== inup debug log started at ${timestamp()} ===\n`, { flag: 'a' });
     }

package/dist/utils/filesystem/scan.js

@@ -5,6 +5,15 @@ exports.findAllPackageJsonFilesAsync = findAllPackageJsonFilesAsync;
 const fs_1 = require("fs");
 const fs_2 = require("fs");
 const path_1 = require("path");
+/**
+ * Normalize a relative path to forward slashes before matching `.inuprc` exclude patterns.
+ * On Windows `path.relative` yields backslash separators (e.g. `packages\skipme`), but users write
+ * exclude regexes with `/` (e.g. `^packages/skipme(?:/|$)`). Without this, excludes silently fail
+ * on Windows and a path the user meant to skip gets scanned and upgraded.
+ */
+function toPosixPath(p) {
+    return p.replace(/\\/g, '/');
+}
 const SKIP_DIRS = new Set([
     'node_modules',
     'dist',
@@ -97,7 +106,8 @@ function findAllPackageJsonFiles(rootDir = process.cwd(), excludePatterns = [],
     const skipSet = buildSkipSet(options.scanDirs);
     const excludeRegexes = excludePatterns.map((pattern) => new RegExp(pattern, 'i'));
     function shouldExcludePath(relativePath) {
-        return excludeRegexes.some((regex) => regex.test(relativePath));
+        const posix = toPosixPath(relativePath);
+        return excludeRegexes.some((regex) => regex.test(posix));
     }
     function reportProgress(currentDir, force = false) {
         if (!onProgress)
@@ -169,7 +179,8 @@ async function findAllPackageJsonFilesAsync(rootDir = process.cwd(), excludePatt
     const skipSet = buildSkipSet(options.scanDirs);
     const excludeRegexes = excludePatterns.map((pattern) => new RegExp(pattern, 'i'));
     function shouldExcludePath(relativePath) {
-        return excludeRegexes.some((regex) => regex.test(relativePath));
+        const posix = toPosixPath(relativePath);
+        return excludeRegexes.some((regex) => regex.test(posix));
     }
     function reportProgress(currentDir, force = false) {
         if (!onProgress)

package/dist/utils/index.js

@@ -23,6 +23,7 @@ __exportStar(require("./exec"), exports);
 __exportStar(require("./git"), exports);
 __exportStar(require("./version"), exports);
 __exportStar(require("./debug-logger"), exports);
+__exportStar(require("./local-env"), exports);
 __exportStar(require("./color"), exports);
 __exportStar(require("./engines"), exports);
 __exportStar(require("./manifest"), exports);

package/dist/utils/local-env.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadInupLocalEnv = loadInupLocalEnv;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * Loads a gitignored `.env.local` from the inup repo itself (NOT the cwd), so
+ * developer-only toggles can be "set once" and apply to every `inup` run in any
+ * project — without committing anything or touching the shell profile.
+ *
+ * The repo is located by walking UP from this file's own directory until a
+ * `.env.local` is found, so it works regardless of nesting depth (src/utils when
+ * type-stripped, dist/utils when compiled) and resolves the inup repo even when
+ * the binary is linked and invoked from a different project directory.
+ *
+ * Fully optional and best-effort: if the file is absent or unreadable, nothing
+ * happens and the run proceeds exactly as before. Existing process env always
+ * wins, so a one-off `INUP_PERF=0 inup` still overrides the file.
+ */
+const ENV_FILE_NAME = '.env.local';
+/** Walk upward from this file's dir to find the .env.local; null if none. */
+function findEnvFile() {
+    let dir = __dirname;
+    const root = (0, path_1.parse)(dir).root;
+    // Cap the walk so a missing file can never loop unbounded.
+    for (let i = 0; i < 12; i++) {
+        const candidate = (0, path_1.join)(dir, ENV_FILE_NAME);
+        if ((0, fs_1.existsSync)(candidate))
+            return candidate;
+        if (dir === root)
+            break;
+        dir = (0, path_1.dirname)(dir);
+    }
+    return null;
+}
+/** Parse a minimal KEY=VALUE env file. Ignores blanks and `#` comments. */
+function parseEnv(contents) {
+    const out = {};
+    for (const rawLine of contents.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        if (!key)
+            continue;
+        let value = line.slice(eq + 1).trim();
+        // Strip a single layer of matching quotes.
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Apply `<inup-repo>/.env.local` into process.env. Existing values are never
+ * overwritten (real env / one-off overrides win). Returns the path if loaded.
+ */
+function loadInupLocalEnv() {
+    try {
+        const file = findEnvFile();
+        if (!file)
+            return null;
+        const parsed = parseEnv((0, fs_1.readFileSync)(file, 'utf8'));
+        for (const [key, value] of Object.entries(parsed)) {
+            if (process.env[key] === undefined) {
+                process.env[key] = value;
+            }
+        }
+        return file;
+    }
+    catch {
+        // Best-effort: never let a dev convenience break a real run.
+        return null;
+    }
+}
+//# sourceMappingURL=local-env.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inup",
-  "version": "1.6.0",
+  "version": "1.6.3",
   "description": "Interactive dependency upgrader for npm, yarn, pnpm & bun. Zero-config, monorepo-ready. Upgrade-interactive for every package manager.",
   "main": "dist/index.js",
   "bin": {
@@ -43,10 +43,10 @@
     "README.md"
   ],
   "devDependencies": {
-    "@types/node": "^25.9.1",
+    "@types/node": "^25.9.4",
     "@types/semver": "^7.7.1",
     "@vitest/coverage-v8": "^4.1.7",
-    "prettier": "^3.8.3",
+    "prettier": "^3.9.4",
     "typescript": "^6.0.3",
     "vitest": "^4.1.7"
   },
@@ -55,20 +55,17 @@
     "commander": "^15.0.0",
     "env-paths": "^4.0.0",
     "nanospinner": "^1.2.2",
-    "semver": "^7.8.1",
-    "undici": "^8.3.0"
+    "semver": "^7.8.5",
+    "undici": "^8.5.0"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.19.0"
   },
   "scripts": {
     "build": "rm -rf dist && tsc",
     "dev": "tsc --watch",
     "start": "node dist/cli.js",
-    "link": "pnpm build && pnpm link --global",
-    "version:patch": "pnpm version patch && git push && git push --tags",
-    "version:minor": "pnpm version minor && git push && git push --tags",
-    "version:major": "pnpm version major && git push && git push --tags",
+    "link": "pnpm build && pnpm add -g .",
     "format": "prettier --write src/**/*.ts",
     "format:check": "prettier --check src/**/*.ts",
     "demo:record": "bash docs/demo/record-demo.sh",