inup 1.6.7 → 1.6.8

package/README.md

@@ -1,3 +1,7 @@
+<p align="center">
+  <a href="https://donfear.github.io/inup/"><img src="docs/brand/inup-logo.webp" alt="inup logo" width="170"></a>
+</p>
+
 # inup — Interactive Dependency Upgrader
 
 [![npm version](https://img.shields.io/npm/v/inup?logo=npm&logoColor=%23CB3837&style=for-the-badge&color=crimson)](https://www.npmjs.com/package/inup)
@@ -12,6 +16,8 @@
 
 **inup** is an interactive CLI for upgrading outdated npm dependencies — npm, yarn, pnpm, and bun all supported. It auto-detects your package manager, works in monorepos and workspaces, and requires zero configuration.
 
+**[Documentation, comparisons & changelog →](https://donfear.github.io/inup/)**
+
 ![Interactive Upgrade Demo](docs/demo/interactive-upgrade.gif)
 
 ## Table of Contents
@@ -68,7 +74,7 @@ inup [options]
 --json                        Print a machine-readable JSON report and exit (read-only)
 -c, --check                   Exit non-zero if updates exist, without writing (for CI)
 --apply                       Non-interactively write upgrades + install (for CI/automation)
---target <level>              With --apply: how far to bump — minor (default) | patch | latest
+--target <level>              With --apply: minor (default, in-range) | patch (same major.minor) | latest
 --debug                       Write verbose debug logs
 ```
 
@@ -94,7 +100,8 @@ inup --apply --target latest # include major bumps; --json to also emit the repo
 
 Unlike `--json` and `--check`, **`--apply` writes**: it bumps `package.json` and runs your package
 manager's install to update the lockfile. By default (`--target minor`) it only applies **in-range**
-updates and leaves majors for you to review; `--target latest` includes majors. It honors `.inuprc`
+updates and leaves majors for you to review; `--target patch` stays within the current
+`major.minor` line (patch bumps only); `--target latest` includes majors. It honors `.inuprc`
 (`ignore`, `exclude`, `scanDirs`) exactly as the report does — a package the config excludes is
 never written. With `--apply --json`, the install output goes to stderr so stdout stays pure JSON.
 

package/dist/app/interactive-ui.js

@@ -1,11 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InteractiveUI = void 0;
+const audit_1 = require("../features/audit");
 const interactive_1 = require("../features/interactive");
 const terminal_1 = require("../shared/terminal");
-const interactive_2 = require("../features/interactive");
-const audit_1 = require("../features/audit");
-const interactive_3 = require("../features/interactive");
 const DEFAULT_VULNERABILITY_DISPLAY_OPTIONS = {
     showPeerDependencyVulnerabilities: false,
     showOptionalDependencyVulnerabilities: false,
@@ -24,7 +22,7 @@ class InteractiveUI {
     options;
     saveExact;
     vulnerabilityAuditController = new audit_1.VulnerabilityAuditController();
-    packageInfoModalController = new interactive_2.PackageInfoModalController();
+    packageInfoModalController = new interactive_1.PackageInfoModalController();
     refreshView;
     constructor(packageManager, options) {
         this.renderer = new interactive_1.UIRenderer();
@@ -40,25 +38,25 @@ class InteractiveUI {
         if (selectionStates.length === 0) {
             return [];
         }
-        const selectedStates = await (0, interactive_3.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => {
+        const selectedStates = await (0, interactive_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => {
             this.refreshView = refresh;
         });
-        return (0, interactive_3.createUpgradeChoices)(selectedStates, this.saveExact);
+        return (0, interactive_1.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     createSelectionStates(packages, previousSelections, includeUpToDate = true) {
-        return (0, interactive_3.createSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections, includeUpToDate);
+        return (0, interactive_1.createSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections, includeUpToDate);
     }
     createPendingSelectionStates(packages, previousSelections) {
-        return (0, interactive_3.createPendingSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections);
+        return (0, interactive_1.createPendingSelectionStates)(packages, (name, version, type) => this.vulnerabilityAuditController.getCachedSummary(name, version, type), previousSelections);
     }
     appendOutdatedBatchToSelectionStates(selectionStates, batch, previousSelections) {
         const outdatedStates = this.createSelectionStates(batch.flatMap((batchItem) => batchItem.packageInfo).filter((pkg) => pkg.isOutdated), previousSelections, false);
         if (outdatedStates.length === 0) {
             return;
         }
-        const seen = new Set(selectionStates.map((state) => (0, interactive_3.selectionKey)(state.name, state.currentVersionSpecifier, state.type, state.catalog)));
+        const seen = new Set(selectionStates.map((state) => (0, interactive_1.selectionKey)(state.name, state.currentVersionSpecifier, state.type, state.catalog)));
         outdatedStates.forEach((state) => {
-            const key = (0, interactive_3.selectionKey)(state.name, state.currentVersionSpecifier, state.type, state.catalog);
+            const key = (0, interactive_1.selectionKey)(state.name, state.currentVersionSpecifier, state.type, state.catalog);
             if (!seen.has(key)) {
                 selectionStates.push(state);
                 seen.add(key);
@@ -68,10 +66,10 @@ class InteractiveUI {
     }
     async selectPackagesToUpgradeProgressive(selectionStates, progress, attachRefresh) {
         this.enqueueSecurityAudit(selectionStates);
-        const selectedStates = await (0, interactive_3.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => {
+        const selectedStates = await (0, interactive_1.runInteractiveSession)(selectionStates, this.packageManager, this.renderer, this.packageInfoModalController, this.vulnerabilityAuditController, this.options, (refresh) => {
             this.refreshView = refresh;
         }, progress, attachRefresh);
-        return (0, interactive_3.createUpgradeChoices)(selectedStates, this.saveExact);
+        return (0, interactive_1.createUpgradeChoices)(selectedStates, this.saveExact);
     }
     enqueueSecurityAudit(selectionStates) {
         this.vulnerabilityAuditController.enqueueStates(selectionStates, () => this.refreshView?.());
@@ -79,10 +77,14 @@ class InteractiveUI {
     async confirmUpgrade(choices) {
         console.log(this.renderer.renderConfirmation(choices));
         return new Promise((resolve) => {
-            // Replaced synchronously below before any keypress can invoke it.
-            let cleanupConfirmationSession = /* v8 ignore next */ () => {
+            // Replaced synchronously below before any keypress can invoke it, so
+            // the placeholder body is unreachable. (The `v8 ignore next` form is
+            // not honored by coverage-v8 here; the block form is.)
+            /* v8 ignore start */
+            let cleanupConfirmationSession = () => {
                 terminal_1.CursorUtils.show();
             };
+            /* v8 ignore stop */
             const handleConfirm = (confirmed) => {
                 cleanupConfirmationSession();
                 resolve(confirmed);
@@ -117,7 +119,7 @@ class InteractiveUI {
                 };
                 terminal_1.CursorUtils.hide();
             }
-            catch (error) {
+            catch {
                 process.off('exit', confirmEmergencyCleanup);
                 terminal_1.TerminalInput.promptForConfirmation('Proceed with upgrade? [Y/n] ')
                     .then(resolve)

package/dist/app/upgrade-runner.js

@@ -5,13 +5,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpgradeRunner = void 0;
 const chalk_1 = __importDefault(require("chalk"));
+const debug_1 = require("../features/debug");
+const interactive_1 = require("../features/interactive");
 const upgrade_1 = require("../features/upgrade");
-const interactive_ui_1 = require("./interactive-ui");
-const upgrade_2 = require("../features/upgrade");
 const package_manager_1 = require("../shared/package-manager");
 const terminal_1 = require("../shared/terminal");
-const interactive_1 = require("../features/interactive");
-const debug_1 = require("../features/debug");
+const interactive_ui_1 = require("./interactive-ui");
 /**
  * Main orchestrator for the inup upgrade process
  */
@@ -35,7 +34,7 @@ class UpgradeRunner {
             showOptionalDependencyVulnerabilities: options?.showOptionalDependencyVulnerabilities ?? false,
             saveExact: options?.saveExact ?? false,
         });
-        this.upgrader = new upgrade_2.PackageUpgrader(this.packageManager);
+        this.upgrader = new upgrade_1.PackageUpgrader(this.packageManager);
     }
     async run() {
         try {
@@ -121,19 +120,15 @@ class UpgradeRunner {
                 }
                 // Validate selected choices before confirmation
                 this.validateSelectedChoices(selectedChoices, latestPackages);
-                // Store current selections for potential return to selection
-                previousSelections = new Map();
-                // Convert selectedChoices back to selection state format
-                // Group by package name and version specifier
-                const choiceMap = new Map();
+                // Store current selections (keyed by package name and version specifier)
+                // in the format expected by selectPackagesToUpgrade, for potential
+                // return to selection.
+                const nextSelections = new Map();
                 selectedChoices.forEach((choice) => {
                     const key = (0, interactive_1.selectionKey)(choice.name, choice.currentVersionSpecifier, choice.dependencyType, choice.catalog);
-                    choiceMap.set(key, choice.upgradeType);
-                });
-                // Convert to the format expected by selectPackagesToUpgrade
-                choiceMap.forEach((upgradeType, key) => {
-                    previousSelections.set(key, upgradeType);
+                    nextSelections.set(key, choice.upgradeType);
                 });
+                previousSelections = nextSelections;
                 // Confirm upgrade
                 shouldProceed = await this.ui.confirmUpgrade(selectedChoices);
                 if (shouldProceed === null) {
@@ -181,7 +176,7 @@ class UpgradeRunner {
         // Print summary of what will be upgraded
         const packageJsonPaths = new Set(selectedChoices.map((c) => c.packageJsonPath));
         const uniquePackages = new Set(selectedChoices.map((c) => c.name));
-        console.log('\n' + chalk_1.default.bold('📋 Upgrade Summary'));
+        console.log(`\n${chalk_1.default.bold('📋 Upgrade Summary')}`);
         console.log(chalk_1.default.gray('─'.repeat(50)));
         console.log(`${chalk_1.default.cyan(uniquePackages.size.toString())} package(s) will be upgraded`);
         console.log(`${chalk_1.default.cyan(packageJsonPaths.size.toString())} package.json file(s) will be modified`);

package/dist/cli.js

@@ -5,18 +5,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCli = runCli;
-const commander_1 = require("commander");
+const node_path_1 = require("node:path");
 const chalk_1 = __importDefault(require("chalk"));
-const path_1 = require("path");
-const index_1 = require("./index");
+const commander_1 = require("commander");
 const headless_1 = require("./features/headless");
-const version_checker_1 = require("./shared/registry/version-checker");
+const index_1 = require("./index");
 const config_1 = require("./shared/config");
 const debug_logger_1 = require("./shared/debug-logger");
-const terminal_1 = require("./shared/terminal");
-const local_env_1 = require("./shared/local-env");
 const git_1 = require("./shared/git");
-const terminal_2 = require("./shared/terminal");
+const local_env_1 = require("./shared/local-env");
+const version_checker_1 = require("./shared/registry/version-checker");
+const terminal_1 = require("./shared/terminal");
 // Load developer-only toggles from <inup-repo>/.env.local before anything reads
 // env. Best-effort, gitignored, never overrides real env. Lets perf/debug be
 // "set once" across every project without shell config.
@@ -25,7 +24,7 @@ const program = new commander_1.Command();
 async function runCli(options) {
     // Resolve colored-output intent before anything renders.
     (0, terminal_1.applyColorSetting)(options.color);
-    const cwd = (0, path_1.resolve)(options.dir);
+    const cwd = (0, node_path_1.resolve)(options.dir);
     if (options.debug || process.env.INUP_DEBUG === '1') {
         (0, debug_logger_1.enableDebugLogging)();
     }
@@ -42,7 +41,7 @@ async function runCli(options) {
     if (interactive) {
         const gitState = (0, git_1.getGitWorkingTreeState)(cwd);
         if (gitState.isRepo && gitState.isDirty) {
-            const shouldProceed = await terminal_2.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
+            const shouldProceed = await terminal_1.TerminalInput.promptForImmediateConfirmation(`${chalk_1.default.yellow('Warning:')} dirty working tree. Proceed anyway? ${chalk_1.default.dim('[y/N]')} `, false);
             if (!shouldProceed) {
                 console.log(chalk_1.default.yellow('Upgrade cancelled.'));
                 return;
@@ -130,12 +129,12 @@ async function runCli(options) {
             ' → ' +
             chalk_1.default.green(updateCheck.latestVersion);
         const line2Plain = ` Run: ${updateCheck.updateCommand}`;
-        const line2 = ' ' + chalk_1.default.gray('Run: ') + chalk_1.default.cyan(updateCheck.updateCommand);
+        const line2 = ` ${chalk_1.default.gray('Run: ')}${chalk_1.default.cyan(updateCheck.updateCommand)}`;
         console.log('');
-        console.log(border('┌' + '─'.repeat(innerWidth) + '┐'));
+        console.log(border(`┌${'─'.repeat(innerWidth)}┐`));
         console.log(border('│') + line1 + padTo(line1Plain.length) + border('│'));
         console.log(border('│') + line2 + padTo(line2Plain.length) + border('│'));
-        console.log(border('└' + '─'.repeat(innerWidth) + '┘'));
+        console.log(border(`└${'─'.repeat(innerWidth)}┘`));
         console.log('');
     }
 }
@@ -154,7 +153,7 @@ program
     .option('--json', 'print a machine-readable JSON report and exit (non-interactive, read-only)')
     .option('-c, --check', 'exit non-zero if updates exist, without writing (for CI; read-only)')
     .option('--apply', 'non-interactively write upgrades to package.json and run install (honors .inuprc ignore/exclude)')
-    .option('--target <level>', 'with --apply: how far to bump — minor | patch | latest (default: minor, in-range only)', 'minor')
+    .option('--target <level>', 'with --apply: how far to bump — minor (in-range) | patch (same major.minor only) | latest (default: minor)', 'minor')
     .action(runCli);
 // Handle uncaught errors gracefully
 process.on('uncaughtException', (error) => {

package/dist/features/audit/headless-audit.js

@@ -36,8 +36,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.auditVulnerabilities = auditVulnerabilities;
 exports.upgradeClears = upgradeClears;
 const semver = __importStar(require("semver"));
-const vulnerability_checker_1 = require("./vulnerability-checker");
 const versions_1 = require("../../shared/versions");
+const vulnerability_checker_1 = require("./vulnerability-checker");
 /**
  * Audit the outdated packages' currently-installed versions (one bulk request, matching the
  * interactive audit) and, for each advisory, cross-reference its affected range against the
@@ -94,17 +94,10 @@ function upgradeClears(target, vulnerableVersions) {
     const comparable = (0, versions_1.toComparableVersion)(target);
     if (!comparable)
         return false;
+    // validRange rejects unparseable ranges above and comparable is a concrete
+    // version, so satisfies() has valid inputs and never throws here.
     if (semver.validRange(vulnerableVersions) === null)
         return false;
-    try {
-        return !semver.satisfies(comparable, vulnerableVersions, { includePrerelease: true });
-        // validRange above already rejected unparseable ranges and satisfies
-        // swallows the rest internally; this is a safety net for semver changes.
-        /* v8 ignore start */
-    }
-    catch {
-        return false;
-    }
-    /* v8 ignore stop */
+    return !semver.satisfies(comparable, vulnerableVersions, { includePrerelease: true });
 }
 //# sourceMappingURL=headless-audit.js.map

package/dist/features/audit/index.js

@@ -14,14 +14,12 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.upgradeClears = exports.auditVulnerabilities = exports.shouldDisplayVulnerabilityForDependency = exports.selectRepresentativeAdvisory = exports.mergeVulnerabilitySummary = exports.getVulnerabilitySeverityColor = exports.getVulnerabilityLinkLabel = exports.getVulnerabilityBadge = exports.createVulnerabilitySummary = exports.VulnerabilityAuditController = exports.BackgroundAuditTracker = exports.fetchVulnerabilities = void 0;
-__exportStar(require("./types"), exports);
-var vulnerability_checker_1 = require("./vulnerability-checker");
-Object.defineProperty(exports, "fetchVulnerabilities", { enumerable: true, get: function () { return vulnerability_checker_1.fetchVulnerabilities; } });
+exports.fetchVulnerabilities = exports.VulnerabilityAuditController = exports.shouldDisplayVulnerabilityForDependency = exports.selectRepresentativeAdvisory = exports.mergeVulnerabilitySummary = exports.getVulnerabilitySeverityColor = exports.getVulnerabilityLinkLabel = exports.getVulnerabilityBadge = exports.createVulnerabilitySummary = exports.upgradeClears = exports.auditVulnerabilities = exports.BackgroundAuditTracker = void 0;
 var background_audit_1 = require("./background-audit");
 Object.defineProperty(exports, "BackgroundAuditTracker", { enumerable: true, get: function () { return background_audit_1.BackgroundAuditTracker; } });
-var vulnerability_audit_controller_1 = require("./vulnerability-audit-controller");
-Object.defineProperty(exports, "VulnerabilityAuditController", { enumerable: true, get: function () { return vulnerability_audit_controller_1.VulnerabilityAuditController; } });
+var headless_audit_1 = require("./headless-audit");
+Object.defineProperty(exports, "auditVulnerabilities", { enumerable: true, get: function () { return headless_audit_1.auditVulnerabilities; } });
+Object.defineProperty(exports, "upgradeClears", { enumerable: true, get: function () { return headless_audit_1.upgradeClears; } });
 var presenter_1 = require("./presenter");
 Object.defineProperty(exports, "createVulnerabilitySummary", { enumerable: true, get: function () { return presenter_1.createVulnerabilitySummary; } });
 Object.defineProperty(exports, "getVulnerabilityBadge", { enumerable: true, get: function () { return presenter_1.getVulnerabilityBadge; } });
@@ -30,7 +28,9 @@ Object.defineProperty(exports, "getVulnerabilitySeverityColor", { enumerable: tr
 Object.defineProperty(exports, "mergeVulnerabilitySummary", { enumerable: true, get: function () { return presenter_1.mergeVulnerabilitySummary; } });
 Object.defineProperty(exports, "selectRepresentativeAdvisory", { enumerable: true, get: function () { return presenter_1.selectRepresentativeAdvisory; } });
 Object.defineProperty(exports, "shouldDisplayVulnerabilityForDependency", { enumerable: true, get: function () { return presenter_1.shouldDisplayVulnerabilityForDependency; } });
-var headless_audit_1 = require("./headless-audit");
-Object.defineProperty(exports, "auditVulnerabilities", { enumerable: true, get: function () { return headless_audit_1.auditVulnerabilities; } });
-Object.defineProperty(exports, "upgradeClears", { enumerable: true, get: function () { return headless_audit_1.upgradeClears; } });
+__exportStar(require("./types"), exports);
+var vulnerability_audit_controller_1 = require("./vulnerability-audit-controller");
+Object.defineProperty(exports, "VulnerabilityAuditController", { enumerable: true, get: function () { return vulnerability_audit_controller_1.VulnerabilityAuditController; } });
+var vulnerability_checker_1 = require("./vulnerability-checker");
+Object.defineProperty(exports, "fetchVulnerabilities", { enumerable: true, get: function () { return vulnerability_checker_1.fetchVulnerabilities; } });
 //# sourceMappingURL=index.js.map

package/dist/features/audit/presenter.js

@@ -19,8 +19,6 @@ function getVulnerabilitySeverityColor(severity) {
             return chalk_1.default.red;
         case 'moderate':
             return chalk_1.default.yellow;
-        case 'low':
-        case 'info':
         default:
             return chalk_1.default.gray;
     }

package/dist/features/audit/vulnerability-audit-controller.js

@@ -2,8 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VulnerabilityAuditController = void 0;
 const background_audit_1 = require("./background-audit");
-const vulnerability_checker_1 = require("./vulnerability-checker");
 const presenter_1 = require("./presenter");
+const vulnerability_checker_1 = require("./vulnerability-checker");
 class VulnerabilityAuditController {
     tracker = new background_audit_1.BackgroundAuditTracker();
     cache = new Map();
@@ -21,7 +21,7 @@ class VulnerabilityAuditController {
         }));
         const added = this.tracker.enqueue(packages);
         if (added > 0) {
-            this.drain(selectionStates, onUpdate);
+            void this.drain(selectionStates, onUpdate);
         }
     }
     async drain(selectionStates, onUpdate) {
@@ -82,7 +82,7 @@ class VulnerabilityAuditController {
             // race window, so it cannot be exercised deterministically in tests.
             /* v8 ignore start */
             if (this.tracker.getProgress().isRunning) {
-                this.drain(selectionStates, onUpdate);
+                void this.drain(selectionStates, onUpdate);
             }
             /* v8 ignore stop */
         });

package/dist/features/audit/vulnerability-checker.js

@@ -14,11 +14,7 @@ function isKnownSeverity(severity) {
     return severity in SEVERITY_ORDER;
 }
 function getHighestSeverity(vulnerabilities) {
-    // The only caller skips empty advisory lists before calling; type-level net.
-    /* v8 ignore start */
-    if (vulnerabilities.length === 0)
-        return null;
-    /* v8 ignore stop */
+    // Caller skips empty advisory lists, so there is always at least one entry.
     let highest = 'info';
     for (const vuln of vulnerabilities) {
         if (SEVERITY_ORDER[vuln.severity] > SEVERITY_ORDER[highest]) {

package/dist/features/changelog/clients/github-client.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GitHubClient = void 0;
-const repository_ref_1 = require("../parsers/repository-ref");
 const config_1 = require("../../../shared/config");
+const repository_ref_1 = require("../parsers/repository-ref");
 const GITHUB_RELEASES_PAGE_LIMIT = 3;
 /**
  * Headers for api.github.com requests. Honors an ambient token (GitHub Actions
@@ -17,7 +17,7 @@ function githubApiHeaders() {
     };
     const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
     if (token) {
-        headers['authorization'] = `Bearer ${token}`;
+        headers.authorization = `Bearer ${token}`;
     }
     return headers;
 }
@@ -30,7 +30,7 @@ function githubApiHeaders() {
 async function fetchGitHubApi(url, signal) {
     const headers = githubApiHeaders();
     const response = await fetch(url, { method: 'GET', headers, signal });
-    if (response.status === 401 && headers['authorization']) {
+    if (response.status === 401 && headers.authorization) {
         const { authorization: _rejected, ...anonymousHeaders } = headers;
         return fetch(url, { method: 'GET', headers: anonymousHeaders, signal });
     }
@@ -86,8 +86,9 @@ class GitHubClient {
         if (!repo)
             return null;
         const cacheKey = `${repo.owner}/${repo.repo}`;
-        if (this.releasesCache.has(cacheKey)) {
-            return this.releasesCache.get(cacheKey);
+        const cached = this.releasesCache.get(cacheKey);
+        if (cached !== undefined) {
+            return cached;
         }
         const releases = [];
         for (let page = 1; page <= GITHUB_RELEASES_PAGE_LIMIT; page += 1) {
@@ -118,8 +119,9 @@ class GitHubClient {
         if (!repo)
             return null;
         const cacheKey = `${repo.owner}/${repo.repo}`;
-        if (this.rawChangelogCache.has(cacheKey)) {
-            return this.rawChangelogCache.get(cacheKey);
+        const cached = this.rawChangelogCache.get(cacheKey);
+        if (cached !== undefined) {
+            return cached;
         }
         const branches = ['main', 'master'];
         const filenames = ['CHANGELOG.md', 'CHANGES.md', 'HISTORY.md'];

package/dist/features/changelog/index.js

@@ -14,6 +14,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./types"), exports);
 __exportStar(require("./services/changelog-service"), exports);
+__exportStar(require("./types"), exports);
 //# sourceMappingURL=index.js.map

package/dist/features/changelog/services/package-metadata-service.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageMetadataService = void 0;
+const inflight_1 = require("../../../shared/http/inflight");
 const npm_registry_client_1 = require("../clients/npm-registry-client");
 const package_metadata_1 = require("../parsers/package-metadata");
-const inflight_1 = require("../../../shared/http/inflight");
 class PackageMetadataService {
     npmRegistryClient;
     cache = new Map();

package/dist/features/changelog/services/release-notes-service.js

@@ -55,8 +55,9 @@ class ReleaseNotesService {
     }
     async fetchReleaseNotesForVersion(packageName, version, signal) {
         const cacheKey = `release-notes:${packageName}@${version}`;
-        if (this.releaseNotesCache.has(cacheKey)) {
-            return this.releaseNotesCache.get(cacheKey);
+        const cached = this.releaseNotesCache.get(cacheKey);
+        if (cached !== undefined) {
+            return cached;
         }
         const inFlight = this.releaseNotesInFlight.get(cacheKey);
         if (inFlight) {

package/dist/features/debug/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./types"), exports);
-__exportStar(require("./performance-tracker"), exports);
 __exportStar(require("./perf-logger"), exports);
+__exportStar(require("./performance-tracker"), exports);
+__exportStar(require("./types"), exports);
 //# sourceMappingURL=index.js.map

package/dist/features/debug/perf-logger.js

@@ -4,8 +4,8 @@ exports.isPerfLoggingEnabled = isPerfLoggingEnabled;
 exports.perfEnv = perfEnv;
 exports.getPerfDir = getPerfDir;
 exports.writePerfLog = writePerfLog;
-const fs_1 = require("fs");
-const path_1 = require("path");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
 const adaptive_controller_1 = require("../../shared/http/adaptive-controller");
 /**
  * Performance debug logger.
@@ -27,7 +27,7 @@ const adaptive_controller_1 = require("../../shared/http/adaptive-controller");
 const PERF_DIR_NAME = '.inup-perf';
 /** Filesystem-safe slug of a project name for use in filenames. */
 function projectSlug(cwd) {
-    const name = (0, path_1.basename)((0, path_1.resolve)(cwd)) || 'root';
+    const name = (0, node_path_1.basename)((0, node_path_1.resolve)(cwd)) || 'root';
     return name.replace(/[^a-zA-Z0-9._-]/g, '-').slice(0, 40);
 }
 function isPerfLoggingEnabled() {
@@ -53,12 +53,12 @@ function perfEnv() {
 function getPerfDir(cwd = process.cwd()) {
     const override = process.env.INUP_PERF_DIR;
     const dir = override
-        ? (0, path_1.isAbsolute)(override)
+        ? (0, node_path_1.isAbsolute)(override)
             ? override
-            : (0, path_1.resolve)(cwd, override)
-        : (0, path_1.join)(cwd, PERF_DIR_NAME);
-    if (!(0, fs_1.existsSync)(dir)) {
-        (0, fs_1.mkdirSync)(dir, { recursive: true });
+            : (0, node_path_1.resolve)(cwd, override)
+        : (0, node_path_1.join)(cwd, PERF_DIR_NAME);
+    if (!(0, node_fs_1.existsSync)(dir)) {
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
     }
     return dir;
 }
@@ -92,10 +92,10 @@ function writePerfLog(config, snapshot) {
         // Project name in the filename keeps multi-project runs distinct when many
         // collect into one centralized INUP_PERF_DIR.
         const fileName = `run-${fileStamp(now)}-${projectSlug(config.cwd)}-${adaptiveTag}-${modeTag}.json`;
-        const filePath = (0, path_1.join)(dir, fileName);
-        (0, fs_1.writeFileSync)(filePath, JSON.stringify(record, null, 2));
+        const filePath = (0, node_path_1.join)(dir, fileName);
+        (0, node_fs_1.writeFileSync)(filePath, JSON.stringify(record, null, 2));
         // Maintain a stable pointer to the most recent run for quick reads.
-        (0, fs_1.writeFileSync)((0, path_1.join)(dir, 'latest.json'), JSON.stringify(record, null, 2));
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'latest.json'), JSON.stringify(record, null, 2));
         // And a cheap one-line-per-run index for fast scanning.
         appendPerfIndex(dir, record);
         if (process.env.INUP_DEBUG === '1') {
@@ -111,7 +111,7 @@ function writePerfLog(config, snapshot) {
 /** Append a single line to a NDJSON index for ultra-cheap scanning, best-effort. */
 function appendPerfIndex(dir, record) {
     try {
-        const line = JSON.stringify({
+        const line = `${JSON.stringify({
             timestamp: record.timestamp,
             wallMs: record.wallMs,
             adaptive: record.config.adaptive,
@@ -119,8 +119,8 @@ function appendPerfIndex(dir, record) {
             uniquePackages: record.snapshot.counts.uniquePackages,
             registryFetch: record.snapshot.phases.registryFetch,
             controlTicks: record.snapshot.controlTicks.length,
-        }) + '\n';
-        (0, fs_1.appendFileSync)((0, path_1.join)(dir, 'index.ndjson'), line);
+        })}\n`;
+        (0, node_fs_1.appendFileSync)((0, node_path_1.join)(dir, 'index.ndjson'), line);
     }
     catch {
         /* best-effort */

package/dist/features/headless/headless-runner.js

@@ -5,12 +5,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HeadlessRunner = void 0;
 const chalk_1 = __importDefault(require("chalk"));
-const upgrade_1 = require("../upgrade");
+const debug_1 = require("../../features/debug");
 const package_manager_1 = require("../../shared/package-manager");
 const versions_1 = require("../../shared/versions");
 const audit_1 = require("../audit");
+const upgrade_1 = require("../upgrade");
 const report_1 = require("./report");
-const debug_1 = require("../../features/debug");
 /**
  * Non-interactive entry point. Resolves the outdated list without rendering the TUI, then either
  * emits a JSON report (--json) or a plain line-based report. With --check, sets a non-zero exit
@@ -95,19 +95,17 @@ class HeadlessRunner {
      * Build `PackageUpgradeChoice[]` from the outdated set per the version policy. Mirrors
      * `createUpgradeChoices` in the TUI: preserves the original range prefix (^/~) unless --save-exact.
      *
-     * - minor/patch: take the in-range target (`rangeVersion`); skip packages whose only update is a
+     * - minor: take the in-range target (`rangeVersion`); skip packages whose only update is a
      *   major (no in-range bump). Uses upgradeType 'range'.
+     * - patch: take the highest patch in the current major.minor line; skip packages whose only
+     *   update crosses a minor (or major) boundary. Uses upgradeType 'range'.
      * - latest: take `latestVersion`; uses upgradeType 'latest' (majors included).
      */
     buildChoices(outdated, target) {
         const saveExact = this.options?.saveExact ?? false;
         const choices = [];
         for (const pkg of outdated) {
-            const useLatest = target === 'latest';
-            // minor/patch only act on packages with an in-range bump; major-only updates are skipped.
-            if (!useLatest && !pkg.hasRangeUpdate)
-                continue;
-            const targetVersion = useLatest ? pkg.latestVersion : pkg.rangeVersion;
+            const targetVersion = this.resolveTargetVersion(pkg, target);
             if (!targetVersion)
                 continue;
             const targetVersionWithPrefix = saveExact
@@ -117,7 +115,7 @@ class HeadlessRunner {
                 name: pkg.name,
                 packageJsonPath: pkg.packageJsonPath,
                 dependencyType: pkg.type,
-                upgradeType: useLatest ? 'latest' : 'range',
+                upgradeType: target === 'latest' ? 'latest' : 'range',
                 targetVersion: targetVersionWithPrefix,
                 currentVersionSpecifier: pkg.currentVersion,
                 catalog: pkg.catalog,
@@ -125,6 +123,21 @@ class HeadlessRunner {
         }
         return choices;
     }
+    /** Resolve the version a package should be bumped to under the given policy, or null to skip. */
+    resolveTargetVersion(pkg, target) {
+        if (target === 'latest') {
+            return pkg.latestVersion || null;
+        }
+        if (target === 'patch') {
+            // Strictly patch-level: computed from the full version list, not `rangeVersion` (which may
+            // be a minor bump). Null when the only updates cross a minor boundary.
+            return (0, versions_1.findHighestPatchVersion)(pkg.currentVersion, pkg.allVersions ?? []);
+        }
+        // minor: in-range bump only; major-only updates are skipped.
+        if (!pkg.hasRangeUpdate)
+            return null;
+        return pkg.rangeVersion || null;
+    }
     /** Resolve the package manager the same way the interactive runner does. */
     resolvePackageManager() {
         const cwd = this.options?.cwd || process.cwd();

package/dist/features/headless/index.js

@@ -15,10 +15,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderPlainReport = exports.buildHeadlessReport = exports.HeadlessRunner = void 0;
-__exportStar(require("./types"), exports);
 var headless_runner_1 = require("./headless-runner");
 Object.defineProperty(exports, "HeadlessRunner", { enumerable: true, get: function () { return headless_runner_1.HeadlessRunner; } });
 var report_1 = require("./report");
 Object.defineProperty(exports, "buildHeadlessReport", { enumerable: true, get: function () { return report_1.buildHeadlessReport; } });
 Object.defineProperty(exports, "renderPlainReport", { enumerable: true, get: function () { return report_1.renderPlainReport; } });
+__exportStar(require("./types"), exports);
 //# sourceMappingURL=index.js.map