inup 1.6.4 → 1.6.5

package/README.md

@@ -6,10 +6,21 @@
 [![CI](https://img.shields.io/github/actions/workflow/status/donfear/inup/ci.yml?branch=main&style=for-the-badge&label=CI)](https://github.com/donfear/inup/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=for-the-badge)](https://github.com/donfear/inup/blob/main/LICENSE)
 
-Interactively upgrade outdated dependencies across npm, yarn, pnpm, and bun. Auto-detects your package manager, works in monorepos and workspaces, and requires zero configuration.
+**inup** is an interactive CLI for upgrading outdated npm dependencies — npm, yarn, pnpm, and bun all supported. It auto-detects your package manager, works in monorepos and workspaces, and requires zero configuration.
 
 ![Interactive Upgrade Demo](docs/demo/interactive-upgrade.gif)
 
+## Table of Contents
+
+- [Quick Start](#quick-start)
+- [Why inup?](#why-inup)
+- [Options](#options)
+- [CI & Scripting](#ci--scripting)
+- [GitHub Action — one rolling upgrade PR](#github-action--one-rolling-upgrade-pr)
+- [Keyboard Shortcuts](#keyboard-shortcuts)
+- [Privacy](#privacy)
+- [License](#license)
+
 ## Quick Start
 
 ```bash
@@ -25,19 +36,18 @@ yarn global add inup
 bun add -g inup
 ```
 
-Run `inup` in any project — it scans for outdated packages and lets you pick what to upgrade.
+Run `inup` in any project — it scans for outdated dependencies and lets you pick what to upgrade.
 
 ## Why inup?
 
-- **All Dependencies at Once** — Dev, peer, and optional dependencies load automatically. No more re-running with `--peer` or `--dev` flags.
-- **Live Toggles** — Filter dependency types (`d`, `p`, `o`) on the fly without restarting.
-- **Zero Config** — Auto-detects npm, yarn, pnpm, or bun from your lockfile.
-- **Monorepo Ready** — Discovers and upgrades across workspaces seamlessly.
-- **Vulnerability Audit** — Flags known security vulnerabilities right in the package list so you know what's risky before upgrading.
-- **Changelog Viewer** — Read release notes and changelogs inline without leaving the terminal.
-- **Built-in Search** — Press `/` to filter packages instantly.
-- **Package Details** — Press `i` to view package info, download stats, and more.
-- **Themes** — Press `t` to switch between color themes.
+- **All Dependencies at Once** — dev, peer, and optional dependencies load automatically. No more re-running with `--peer` or `--dev` flags.
+- **Live Toggles** — filter dependency types (`d`, `p`, `o`) on the fly without restarting.
+- **Zero Config** — auto-detects npm, yarn, pnpm, or bun from your lockfile.
+- **Monorepo & Workspaces Ready** — discovers and upgrades dependencies across every workspace in one pass.
+- **Vulnerability Audit** — flags known security vulnerabilities right in the package list, so you know what's risky before you upgrade.
+- **Changelog Viewer** — read release notes and changelogs inline without leaving the terminal.
+- **Built-in Search** — press `/` to filter packages instantly.
+- **Package Details** — press `i` to view package info, download stats, and more.
 
 ## Options
 
@@ -58,6 +68,9 @@ inup [options]
 
 ## CI & Scripting
 
+Run inup non-interactively to gate builds on outdated or vulnerable dependencies, generate a
+machine-readable dependency report, or auto-apply safe upgrades in CI/CD.
+
 `inup` runs headless automatically when stdout isn't a TTY or `$CI` is set, so it never hangs in a
 pipeline waiting on the interactive UI. Both `--json` and `--check` are **read-only** — they report,
 they never edit `package.json` or install.
@@ -70,6 +83,9 @@ inup --apply                 # write safe in-range bumps + install (non-interact
 inup --apply --target latest # include major bumps; --json to also emit the report
 ```
 
+<details>
+<summary><strong>Details: <code>--apply</code>, JSON schema, and vulnerability cross-referencing</strong></summary>
+
 Unlike `--json` and `--check`, **`--apply` writes**: it bumps `package.json` and runs your package
 manager's install to update the lockfile. By default (`--target minor`) it only applies **in-range**
 updates and leaves majors for you to review; `--target latest` includes majors. It honors `.inuprc`
@@ -91,10 +107,12 @@ agents can pin to a known shape.
 Output hygiene: with `--json`, stdout carries **only** the JSON document; all progress and warnings go
 to stderr. Exit codes: `0` up to date, `1` updates exist (`--check`), `2` error.
 
+</details>
+
 ## GitHub Action — one rolling upgrade PR
 
-Run inup on a schedule and get **one rolling pull request** with safe upgrades applied. Re-runs update
-the same PR instead of opening new ones.
+Automate dependency upgrades for your GitHub repo: run inup on a schedule and get **one rolling pull
+request** with safe upgrades applied. Re-runs update the same PR instead of opening new ones.
 
 Add this workflow to **your** repo:
 
@@ -103,7 +121,7 @@ Add this workflow to **your** repo:
 name: inup
 on:
   schedule:
-    - cron: '0 6 * * *' # daily at 06:00 UTC
+    - cron: '17 5 * * *' # daily around 05:17 UTC
   workflow_dispatch: {}
 
 permissions:
@@ -123,6 +141,40 @@ jobs:
 That's it. Also enable Settings → Actions → General → **Workflow permissions** →
 **"Allow GitHub Actions to create and approve pull requests"** so the action can open the PR.
 
+Scheduled workflows are not real-time timers. [GitHub documents](https://docs.github.com/actions/using-workflows/events-that-trigger-workflows#schedule)
+that `schedule` runs can be delayed during busy periods; the start of each hour is especially busy,
+and very high load can even drop queued scheduled runs. If you want upgrades ready by a specific time,
+schedule inup earlier than you need it and avoid `:00` cron minutes. Otherwise, let the scheduled run
+arrive when GitHub starts it; the action will still update the same rolling PR when it runs.
+
+### What the action creates
+
+When inup finds applicable upgrades, the workflow commits the changed manifest/lockfile and opens or
+updates one pull request. The PR body looks like this:
+
+```md
+## 📦 Dependency upgrades
+
+Scanned **18** packages — **3** unique upgrade(s) (1 with a major available, 1 with known vulnerabilities).
+
+### ✅ Applied in this PR
+
+- `eslint` `^9.28.0` → `^9.30.1` (devDependencies)
+- `undici` `^7.10.0` → `^7.11.0` (dependencies)
+- `vite` `^6.3.0` → `^6.3.5` (devDependencies)
+
+### Updates
+
+| Package | Current | → In-range | Latest | Type | Applied | Major? | Security |
+|---|---|---|---|---|---|---|---|
+| `eslint` | ^9.28.0 | ^9.30.1 | 9.30.1 | devDependencies | ✅ | — | — |
+| `undici` | ^7.10.0 | ^7.11.0 | 7.11.0 | dependencies | ✅ | — | 🟢 fixed by in-range bump |
+| `vite` | ^6.3.0 | ^6.3.5 | 7.0.0 | devDependencies | ✅ | ⚠️ yes | — |
+```
+
+<details>
+<summary><strong>Details: commit attribution, all inputs, and outputs</strong></summary>
+
 ### Commit as you, not the bot
 
 By default the upgrade commit is authored by `github-actions[bot]`. To attribute it to **you**, store
@@ -158,6 +210,8 @@ Outputs: `outdated`, `vulnerable`, `pull-request-number`.
 > `@v1` floats to the latest `1.x` release; pin to `@v1.6.2` or a SHA for reproducible runs. inup
 > honors your `.inuprc` (`ignore`, `exclude`, `scanDirs`).
 
+</details>
+
 ## Keyboard Shortcuts
 
 <!-- KEYS:START -->
@@ -189,7 +243,7 @@ Outputs: `outdated`, `vulnerable`, `pull-request-number`.
 
 ## Privacy
 
-No tracking, no telemetry, no data collection. Package metadata is fetched directly from the npm registry. Download counts come from the npm downloads API. Changelog and release notes are fetched from GitHub.
+No tracking, no telemetry, no data collection. Package metadata is fetched directly from the npm registry, download counts from the npm downloads API, and changelogs/release notes from GitHub.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "inup",
-  "version": "1.6.4",
+  "version": "1.6.5",
   "description": "Interactive dependency upgrader for npm, yarn, pnpm & bun. Zero-config, monorepo-ready. Upgrade-interactive for every package manager.",
   "main": "dist/index.js",
   "bin": {
@@ -45,10 +45,10 @@
   "devDependencies": {
     "@types/node": "^25.9.4",
     "@types/semver": "^7.7.1",
-    "@vitest/coverage-v8": "^4.1.7",
+    "@vitest/coverage-v8": "^4.1.9",
     "prettier": "^3.9.4",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.7"
+    "vitest": "^4.1.9"
   },
   "dependencies": {
     "chalk": "^5.6.2",