inup 1.6.2 → 1.6.3

package/README.md

@@ -51,6 +51,8 @@ inup [options]
 --package-manager <name>      Force package manager (npm, yarn, pnpm, bun)
 --json                        Print a machine-readable JSON report and exit (read-only)
 -c, --check                   Exit non-zero if updates exist, without writing (for CI)
+--apply                       Non-interactively write upgrades + install (for CI/automation)
+--target <level>              With --apply: how far to bump — minor (default) | patch | latest
 --debug                       Write verbose debug logs
 ```
 
@@ -61,11 +63,19 @@ pipeline waiting on the interactive UI. Both `--json` and `--check` are **read-o
 they never edit `package.json` or install.
 
 ```bash
-inup --check            # exit 1 if anything is outdated → fails the build
-inup --json | jq        # structured drift report for dashboards/bots
-inup | cat              # plain line-based report when piped to a log
+inup --check                 # exit 1 if anything is outdated → fails the build
+inup --json | jq             # structured drift report for dashboards/bots
+inup | cat                   # plain line-based report when piped to a log
+inup --apply                 # write safe in-range bumps + install (non-interactive)
+inup --apply --target latest # include major bumps; --json to also emit the report
 ```
 
+Unlike `--json` and `--check`, **`--apply` writes**: it bumps `package.json` and runs your package
+manager's install to update the lockfile. By default (`--target minor`) it only applies **in-range**
+updates and leaves majors for you to review; `--target latest` includes majors. It honors `.inuprc`
+(`ignore`, `exclude`, `scanDirs`) exactly as the report does — a package the config excludes is
+never written. With `--apply --json`, the install output goes to stderr so stdout stays pure JSON.
+
 Each reported package carries its health signals: `deprecated` (npm deprecation message), `enginesNode`
 (declared `engines.node`), and `vulnerability` (known advisories on the currently-installed version,
 from one bulk `npm audit`-style request). Every advisory is **cross-referenced against the upgrade
@@ -81,6 +91,73 @@ agents can pin to a known shape.
 Output hygiene: with `--json`, stdout carries **only** the JSON document; all progress and warnings go
 to stderr. Exit codes: `0` up to date, `1` updates exist (`--check`), `2` error.
 
+## GitHub Action — one rolling upgrade PR
+
+Run inup on a schedule and get **one rolling pull request** with safe upgrades applied. Re-runs update
+the same PR instead of opening new ones.
+
+Add this workflow to **your** repo:
+
+```yaml
+# .github/workflows/inup.yml
+name: inup
+on:
+  schedule:
+    - cron: '0 6 * * *' # daily at 06:00 UTC
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upgrade:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: donfear/inup@v1
+        with:
+          target: minor # minor (default) | patch | latest
+```
+
+That's it. Also enable Settings → Actions → General → **Workflow permissions** →
+**"Allow GitHub Actions to create and approve pull requests"** so the action can open the PR.
+
+### Commit as you, not the bot
+
+By default the upgrade commit is authored by `github-actions[bot]`. To attribute it to **you**, store
+your name/email as repo secrets (Settings → Secrets and variables → Actions) and pass `committer`/`author`:
+
+```yaml
+      - uses: donfear/inup@v1
+        with:
+          committer: ${{ secrets.GH_USERNAME }} <${{ secrets.GH_EMAIL }}>
+          author: ${{ secrets.GH_USERNAME }} <${{ secrets.GH_EMAIL }}>
+```
+
+### All inputs
+
+| Input | Default | Description |
+|---|---|---|
+| `target` | `minor` | How far to bump: `minor` (in-range), `patch`, or `latest` (includes majors). |
+| `directory` | `.` | Directory to run in. |
+| `package-manager` | _(auto)_ | Force `npm`/`yarn`/`pnpm`/`bun`; empty auto-detects from the lockfile. |
+| `node-version` | `22` | Node.js version for the run (minimum `22.19`). |
+| `inup-version` | `latest` | inup version to run (pin for reproducible runs). |
+| `pr-branch` | `inup/dependency-upgrades` | Branch for the rolling PR. |
+| `pr-title` | `chore(deps): dependency upgrades` | PR title. |
+| `commit-message` | `chore(deps): upgrade dependencies via inup` | Commit message. |
+| `base` | _(default branch)_ | Base branch the PR targets. |
+| `labels` | `dependencies` | Labels to apply to the PR. |
+| `token` | `${{ github.token }}` | Token to push + open the PR. Pass a PAT to also trigger CI on the PR. |
+| `committer` | `github-actions[bot]` | Commit committer, as `Name <email>`. |
+| `author` | _(triggering user)_ | Commit author, as `Name <email>`. |
+
+Outputs: `outdated`, `vulnerable`, `pull-request-number`.
+
+> `@v1` floats to the latest `1.x` release; pin to `@v1.6.2` or a SHA for reproducible runs. inup
+> honors your `.inuprc` (`ignore`, `exclude`, `scanDirs`).
+
 ## Keyboard Shortcuts
 
 <!-- KEYS:START -->

package/dist/cli.js

@@ -28,8 +28,14 @@ async function runCli(options) {
         (0, utils_1.enableDebugLogging)();
     }
     // Headless when piped, in CI, or when a non-interactive flag is set. The TUI only renders in
-    // interactive mode; everything else routes through the read-only headless report path.
-    const interactive = !!process.stdout.isTTY && !process.env.CI && !options.json && !options.check;
+    // interactive mode; everything else routes through the headless path (read-only, unless --apply).
+    const interactive = !!process.stdout.isTTY && !process.env.CI && !options.json && !options.check && !options.apply;
+    // Validate --target early so a typo fails fast instead of silently defaulting.
+    if (options.target && !['minor', 'patch', 'latest'].includes(options.target)) {
+        console.error(chalk_1.default.red(`Invalid target: ${options.target}`));
+        console.error(chalk_1.default.yellow('Valid options: minor, patch, latest'));
+        process.exit(1);
+    }
     // The dirty-tree prompt would hang without a TTY; headless is read-only anyway, so skip it.
     if (interactive) {
         const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
@@ -99,7 +105,12 @@ async function runCli(options) {
     // Non-interactive (piped / CI / --json / --check) routes to the read-only headless feature;
     // only the interactive path builds the full TUI runner.
     if (!interactive) {
-        await new headless_1.HeadlessRunner(runnerOptions).run({ json: options.json, check: options.check });
+        await new headless_1.HeadlessRunner(runnerOptions).run({
+            json: options.json,
+            check: options.check,
+            apply: options.apply,
+            target: options.target || 'minor',
+        });
         return;
     }
     await new index_1.UpgradeRunner(runnerOptions).run();
@@ -140,6 +151,8 @@ program
     .option('--save-exact', 'write exact versions instead of preserving the range prefix (^/~)')
     .option('--json', 'print a machine-readable JSON report and exit (non-interactive, read-only)')
     .option('-c, --check', 'exit non-zero if updates exist, without writing (for CI; read-only)')
+    .option('--apply', 'non-interactively write upgrades to package.json and run install (honors .inuprc ignore/exclude)')
+    .option('--target <level>', 'with --apply: how far to bump — minor | patch | latest (default: minor, in-range only)', 'minor')
     .action(runCli);
 // Handle uncaught errors gracefully
 process.on('uncaughtException', (error) => {

package/dist/core/upgrader.js

@@ -12,12 +12,17 @@ const child_process_1 = require("child_process");
 const utils_1 = require("../utils");
 class PackageUpgrader {
     packageManager;
-    constructor(packageManager) {
+    quiet;
+    /** When quiet, send our own progress to stderr so stdout stays reserved for the JSON document. */
+    log;
+    constructor(packageManager, options) {
         this.packageManager = packageManager;
+        this.quiet = options?.quiet ?? false;
+        this.log = this.quiet ? (msg) => console.error(msg) : (msg) => console.log(msg);
     }
     async upgradePackages(choices, _packageInfos) {
         if (choices.length === 0) {
-            console.log(chalk_1.default.yellow('No packages to upgrade.'));
+            this.log(chalk_1.default.yellow('No packages to upgrade.'));
             return;
         }
         // Group choices by package.json path and dependency type
@@ -26,12 +31,12 @@ class PackageUpgrader {
             if (choiceList.length === 0)
                 continue;
             const [packageJsonPath, type] = fileAndType.split('|');
-            console.log(`Processing ${type} in ${packageJsonPath}`);
+            this.log(`Processing ${type} in ${packageJsonPath}`);
             await this.upgradeChoiceGroup(choiceList, packageJsonPath, type);
         }
         // Count unique packages upgraded
         const uniquePackages = new Set(choices.map((c) => c.name));
-        console.log(chalk_1.default.green(`\n✅ Successfully upgraded ${uniquePackages.size} package(s)!`));
+        this.log(chalk_1.default.green(`\n✅ Successfully upgraded ${uniquePackages.size} package(s)!`));
         // Execute package manager install after all upgrades are complete
         await this.runInstall(choices);
     }
@@ -50,16 +55,23 @@ class PackageUpgrader {
             (0, utils_1.executeCommand)(`${this.packageManager.name} --version`, installDir);
         }
         catch (error) {
-            console.log(chalk_1.default.yellow(`\n⚠️  ${this.packageManager.displayName} is detected but not installed on your system.\n` +
+            this.log(chalk_1.default.yellow(`\n⚠️  ${this.packageManager.displayName} is detected but not installed on your system.\n` +
                 `Please run the install command manually:\n` +
                 `  cd ${installDir}\n` +
                 `  ${this.packageManager.installCommand}\n`));
             return; // Skip install, let user do it manually
         }
-        console.log(chalk_1.default.cyan(`\n📦 Running ${this.packageManager.installCommand}...\n`));
-        const result = (0, child_process_1.spawnSync)(this.packageManager.installCommand, {
+        // We just rewrote package.json, so the install must be allowed to regenerate the lockfile.
+        // pnpm/yarn default to frozen/immutable installs under CI; writeInstallCommand opts out.
+        const installCommand = this.packageManager.writeInstallCommand ?? this.packageManager.installCommand;
+        this.log(chalk_1.default.cyan(`\n📦 Running ${installCommand}...\n`));
+        // In quiet mode, send the install child's stdout to *our* stderr (fd 2). The child uses
+        // inherited fds, so its progress output bypasses any JS shim — redirecting at spawn time is
+        // the only reliable way to keep stdout reserved for the --json document. stderr stays inherited.
+        const stdio = this.quiet ? ['inherit', 2, 'inherit'] : 'inherit';
+        const result = (0, child_process_1.spawnSync)(installCommand, {
             cwd: installDir,
-            stdio: 'inherit',
+            stdio,
             shell: true,
         });
         if (result.error) {
@@ -67,9 +79,9 @@ class PackageUpgrader {
         }
         if (result.status !== 0) {
             if (result.signal) {
-                throw new Error(`${this.packageManager.installCommand} terminated by signal ${result.signal}`);
+                throw new Error(`${installCommand} terminated by signal ${result.signal}`);
             }
-            throw new Error(`${this.packageManager.installCommand} exited with code ${result.status}`);
+            throw new Error(`${installCommand} exited with code ${result.status}`);
         }
     }
     groupChoicesByFileAndType(choices) {
@@ -86,11 +98,14 @@ class PackageUpgrader {
     async upgradeChoiceGroup(choices, packageJsonPath, type) {
         // Validate that package.json exists
         if (!(0, fs_1.existsSync)(packageJsonPath)) {
-            console.warn(chalk_1.default.yellow(`⚠️  Skipping ${type} in ${packageJsonPath} - package.json file not found`));
+            this.log(chalk_1.default.yellow(`⚠️  Skipping ${type} in ${packageJsonPath} - package.json file not found`));
             return;
         }
         const packageDir = packageJsonPath.replace('/package.json', '');
-        const spinner = (0, nanospinner_1.createSpinner)(`Upgrading ${type} in ${packageDir}...`).start();
+        // The spinner animates on stdout; skip it in quiet mode so the --json document stays clean.
+        const spinner = this.quiet
+            ? null
+            : (0, nanospinner_1.createSpinner)(`Upgrading ${type} in ${packageDir}...`).start();
         try {
             // Read the current package.json — keep the raw text so we can round-trip its formatting
             const rawContent = (0, fs_1.readFileSync)(packageJsonPath, 'utf-8');
@@ -128,15 +143,21 @@ class PackageUpgrader {
                     (0, fs_1.writeFileSync)(packageJsonPath, nextContent);
                 }
             }
-            spinner.success({ text: `Upgraded ${choices.length} ${type} in ${packageDir}` });
+            if (spinner)
+                spinner.success({ text: `Upgraded ${choices.length} ${type} in ${packageDir}` });
+            else
+                this.log(chalk_1.default.green(`✔ Upgraded ${choices.length} ${type} in ${packageDir}`));
             // Show which packages were upgraded
             choices.forEach((choice) => {
                 const upgradeTypeColor = choice.upgradeType === 'range' ? chalk_1.default.yellow : chalk_1.default.red;
-                console.log(`  ${chalk_1.default.green('✓')} ${chalk_1.default.cyan(choice.name)} → ${upgradeTypeColor(choice.targetVersion)}`);
+                this.log(`  ${chalk_1.default.green('✓')} ${chalk_1.default.cyan(choice.name)} → ${upgradeTypeColor(choice.targetVersion)}`);
             });
         }
         catch (error) {
-            spinner.error({ text: `Failed to upgrade ${type} in ${packageDir}` });
+            if (spinner)
+                spinner.error({ text: `Failed to upgrade ${type} in ${packageDir}` });
+            else
+                this.log(chalk_1.default.red(`✖ Failed to upgrade ${type} in ${packageDir}`));
             console.error(chalk_1.default.red(`Error: ${error}`));
             throw error;
         }

package/dist/features/headless/headless-runner.js

@@ -6,20 +6,26 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.HeadlessRunner = void 0;
 const chalk_1 = __importDefault(require("chalk"));
 const package_detector_1 = require("../../core/package-detector");
+const upgrader_1 = require("../../core/upgrader");
+const package_manager_detector_1 = require("../../services/package-manager-detector");
+const version_1 = require("../../ui/utils/version");
 const vulnerability_audit_1 = require("./vulnerability-audit");
 const report_1 = require("./report");
 const debug_1 = require("../../features/debug");
 /**
  * Non-interactive entry point. Resolves the outdated list without rendering the TUI, then either
  * emits a JSON report (--json) or a plain line-based report. With --check, sets a non-zero exit
- * code when updates exist so CI can gate on it. Read-only: never writes package.json or installs.
+ * code when updates exist so CI can gate on it. With --apply, writes the bumps to package.json and
+ * runs install — the only non-interactive write path.
  *
- * This is the headless counterpart to the interactive `UpgradeRunner`; it shares only the
- * `PackageDetector` (the scan/resolve layer), not the UI/upgrade machinery.
+ * This is the headless counterpart to the interactive `UpgradeRunner`; it shares the
+ * `PackageDetector` (scan/resolve) and, for --apply, the `PackageUpgrader` (write + install).
  */
 class HeadlessRunner {
     detector;
+    options;
     constructor(options) {
+        this.options = options;
         this.detector = new package_detector_1.PackageDetector(options);
     }
     async run(options) {
@@ -47,11 +53,18 @@ class HeadlessRunner {
             // Audit the current versions (one bulk request, best-effort) and cross-reference each
             // advisory against the upgrade targets, so the report says whether upgrading *fixes* it.
             const vulnerabilities = await (0, vulnerability_audit_1.auditVulnerabilities)(outdated);
+            // Build the report from the *pre-apply* outdated set: it describes what this run addressed.
+            const report = (0, report_1.buildHeadlessReport)(packages, outdated, vulnerabilities);
+            // --apply writes the bumps + lockfile. The scan above already honored .inuprc
+            // (ignore/exclude/scanDirs), so the set we write is exactly the set we report — never more.
+            if (options.apply) {
+                await this.applyUpgrades(outdated, options.target ?? 'minor', !!options.json);
+            }
             if (options.json) {
                 // stdout is reserved for the JSON document only.
-                console.log(JSON.stringify((0, report_1.buildHeadlessReport)(packages, outdated, vulnerabilities), null, 2));
+                console.log(JSON.stringify(report, null, 2));
             }
-            else {
+            else if (!options.apply) {
                 console.log((0, report_1.renderPlainReport)(outdated, vulnerabilities));
             }
             // Exit 1 only means "updates exist" (like `prettier --check`); 2 is reserved for errors.
@@ -64,6 +77,61 @@ class HeadlessRunner {
             process.exit(2);
         }
     }
+    /**
+     * Apply upgrades to the already-filtered outdated set, by version policy. Reuses the interactive
+     * write path (`PackageUpgrader`) verbatim — we only build the choices programmatically instead of
+     * from a TUI selection. No path/package filtering happens here: `outdated` is config-filtered.
+     */
+    async applyUpgrades(outdated, target, json) {
+        const choices = this.buildChoices(outdated, target);
+        if (choices.length === 0)
+            return;
+        const packageManager = this.resolvePackageManager();
+        // With --json, run the upgrader quietly: its own progress + the install child's stdout go to
+        // stderr, leaving stdout for the JSON document only.
+        const upgrader = new upgrader_1.PackageUpgrader(packageManager, { quiet: json });
+        await upgrader.upgradePackages(choices, outdated);
+    }
+    /**
+     * Build `PackageUpgradeChoice[]` from the outdated set per the version policy. Mirrors
+     * `createUpgradeChoices` in the TUI: preserves the original range prefix (^/~) unless --save-exact.
+     *
+     * - minor/patch: take the in-range target (`rangeVersion`); skip packages whose only update is a
+     *   major (no in-range bump). Uses upgradeType 'range'.
+     * - latest: take `latestVersion`; uses upgradeType 'latest' (majors included).
+     */
+    buildChoices(outdated, target) {
+        const saveExact = this.options?.saveExact ?? false;
+        const choices = [];
+        for (const pkg of outdated) {
+            const useLatest = target === 'latest';
+            // minor/patch only act on packages with an in-range bump; major-only updates are skipped.
+            if (!useLatest && !pkg.hasRangeUpdate)
+                continue;
+            const targetVersion = useLatest ? pkg.latestVersion : pkg.rangeVersion;
+            if (!targetVersion)
+                continue;
+            const targetVersionWithPrefix = saveExact
+                ? targetVersion
+                : (0, version_1.applyVersionPrefix)(pkg.currentVersion, targetVersion);
+            choices.push({
+                name: pkg.name,
+                packageJsonPath: pkg.packageJsonPath,
+                dependencyType: pkg.type,
+                upgradeType: useLatest ? 'latest' : 'range',
+                targetVersion: targetVersionWithPrefix,
+                currentVersionSpecifier: pkg.currentVersion,
+            });
+        }
+        return choices;
+    }
+    /** Resolve the package manager the same way the interactive runner does. */
+    resolvePackageManager() {
+        const cwd = this.options?.cwd || process.cwd();
+        return this.options?.packageManager
+            ? package_manager_detector_1.PackageManagerDetector.getInfo(this.options.packageManager)
+            : package_manager_detector_1.PackageManagerDetector.detect(cwd);
+    }
 }
 exports.HeadlessRunner = HeadlessRunner;
 //# sourceMappingURL=headless-runner.js.map

package/dist/services/package-manager-detector.js

@@ -22,6 +22,8 @@ const PACKAGE_MANAGERS = {
         lockFile: 'yarn.lock',
         workspaceFile: null, // Uses package.json workspaces field
         installCommand: 'yarn install',
+        // Yarn Berry defaults to immutable installs in CI; --no-immutable lets the lockfile update.
+        writeInstallCommand: 'yarn install --no-immutable',
         color: chalk_1.default.blue,
     },
     pnpm: {
@@ -30,6 +32,8 @@ const PACKAGE_MANAGERS = {
         lockFile: 'pnpm-lock.yaml',
         workspaceFile: 'pnpm-workspace.yaml',
         installCommand: 'pnpm install',
+        // pnpm defaults to --frozen-lockfile in CI; --no-frozen-lockfile lets the lockfile update.
+        writeInstallCommand: 'pnpm install --no-frozen-lockfile',
         color: chalk_1.default.yellow,
     },
     bun: {

package/dist/utils/filesystem/scan.js

@@ -5,6 +5,15 @@ exports.findAllPackageJsonFilesAsync = findAllPackageJsonFilesAsync;
 const fs_1 = require("fs");
 const fs_2 = require("fs");
 const path_1 = require("path");
+/**
+ * Normalize a relative path to forward slashes before matching `.inuprc` exclude patterns.
+ * On Windows `path.relative` yields backslash separators (e.g. `packages\skipme`), but users write
+ * exclude regexes with `/` (e.g. `^packages/skipme(?:/|$)`). Without this, excludes silently fail
+ * on Windows and a path the user meant to skip gets scanned and upgraded.
+ */
+function toPosixPath(p) {
+    return p.replace(/\\/g, '/');
+}
 const SKIP_DIRS = new Set([
     'node_modules',
     'dist',
@@ -97,7 +106,8 @@ function findAllPackageJsonFiles(rootDir = process.cwd(), excludePatterns = [],
     const skipSet = buildSkipSet(options.scanDirs);
     const excludeRegexes = excludePatterns.map((pattern) => new RegExp(pattern, 'i'));
     function shouldExcludePath(relativePath) {
-        return excludeRegexes.some((regex) => regex.test(relativePath));
+        const posix = toPosixPath(relativePath);
+        return excludeRegexes.some((regex) => regex.test(posix));
     }
     function reportProgress(currentDir, force = false) {
         if (!onProgress)
@@ -169,7 +179,8 @@ async function findAllPackageJsonFilesAsync(rootDir = process.cwd(), excludePatt
     const skipSet = buildSkipSet(options.scanDirs);
     const excludeRegexes = excludePatterns.map((pattern) => new RegExp(pattern, 'i'));
     function shouldExcludePath(relativePath) {
-        return excludeRegexes.some((regex) => regex.test(relativePath));
+        const posix = toPosixPath(relativePath);
+        return excludeRegexes.some((regex) => regex.test(posix));
     }
     function reportProgress(currentDir, force = false) {
         if (!onProgress)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inup",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "Interactive dependency upgrader for npm, yarn, pnpm & bun. Zero-config, monorepo-ready. Upgrade-interactive for every package manager.",
   "main": "dist/index.js",
   "bin": {
@@ -45,10 +45,10 @@
   "devDependencies": {
     "@types/node": "^25.9.4",
     "@types/semver": "^7.7.1",
-    "@vitest/coverage-v8": "^4.1.9",
+    "@vitest/coverage-v8": "^4.1.7",
     "prettier": "^3.9.4",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.7"
   },
   "dependencies": {
     "chalk": "^5.6.2",
@@ -59,16 +59,13 @@
     "undici": "^8.5.0"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=22.19.0"
   },
   "scripts": {
     "build": "rm -rf dist && tsc",
     "dev": "tsc --watch",
     "start": "node dist/cli.js",
-    "link": "pnpm build && pnpm link --global",
-    "version:patch": "pnpm version patch && git push && git push --tags",
-    "version:minor": "pnpm version minor && git push && git push --tags",
-    "version:major": "pnpm version major && git push && git push --tags",
+    "link": "pnpm build && pnpm add -g .",
     "format": "prettier --write src/**/*.ts",
     "format:check": "prettier --check src/**/*.ts",
     "demo:record": "bash docs/demo/record-demo.sh",