Security News
vlt Debuts New JavaScript Package Manager and Serverless Registry at NodeConf EU
vlt introduced its new package manager and a serverless registry this week, innovating in a space where npm has stagnated.
update-notifier
Advanced tools
The update-notifier npm package is used to inform users when a newer version of a particular npm package is available. It is particularly useful for CLI tools to notify users to update to the latest version.
Basic Usage
This feature allows you to set up a basic notifier that checks for updates to the package specified in the package.json file. If an update is available, it will notify the user.
const updateNotifier = require('update-notifier');
const pkg = require('./package.json');
const notifier = updateNotifier({ pkg });
if (notifier.update) {
notifier.notify();
}
Custom Message
This feature allows you to customize the message that is displayed to the user when an update is available.
const updateNotifier = require('update-notifier');
const pkg = require('./package.json');
const notifier = updateNotifier({ pkg });
if (notifier.update) {
notifier.notify({
message: 'Update available: ' + notifier.update.latest + '. Run `npm install -g ' + pkg.name + '` to update.'
});
}
Check Interval
This feature allows you to set the interval at which the update check is performed. In this example, the check is performed once every 24 hours.
const updateNotifier = require('update-notifier');
const pkg = require('./package.json');
const notifier = updateNotifier({ pkg, updateCheckInterval: 1000 * 60 * 60 * 24 }); // 1 day
if (notifier.update) {
notifier.notify();
}
npm-check is a tool that checks for outdated, incorrect, and unused dependencies. It provides a more comprehensive check compared to update-notifier, as it can also identify unused packages and incorrect versions.
npm-outdated is a built-in npm command that checks for outdated packages. It provides a list of all outdated packages in a project, making it more suitable for project-wide updates rather than individual package notifications.
Update notifications for your CLI app
Inform users of your package of updates in a non-intrusive way.
npm install update-notifier
import updateNotifier from 'update-notifier';
import packageJson from './package.json' assert {type: 'json'};
updateNotifier({pkg: packageJson}).notify();
import updateNotifier from 'update-notifier';
import packageJson from './package.json' assert {type: 'json'};
// Checks for available update and returns an instance
const notifier = updateNotifier({pkg: packageJson});
// Notify using the built-in convenience method
notifier.notify();
// `notifier.update` contains some useful info about the update
console.log(notifier.update);
/*
{
latest: '1.0.1',
current: '1.0.0',
type: 'patch', // Possible values: latest, major, minor, patch, prerelease, build
name: 'pageres'
}
*/
const notifier = updateNotifier({
pkg,
updateCheckInterval: 1000 * 60 * 60 * 24 * 7 // 1 week
});
if (notifier.update) {
console.log(`Update available: ${notifier.update.latest}`);
}
Whenever you initiate the update notifier and it's not within the interval threshold, it will asynchronously check with npm in the background for available updates, then persist the result. The next time the notifier is initiated, the result will be loaded into the .update
property. This prevents any impact on your package startup performance.
The update check is done in a unref'ed child process. This means that if you call process.exit
, the check will still be performed in its own process.
The first time the user runs your app, it will check for an update, and even if an update is available, it will wait the specified updateCheckInterval
before notifying the user. This is done to not be annoying to the user, but might surprise you as an implementer if you're testing whether it works. Check out example.js
to quickly test out update-notifier
and see how you can test that it works in your app.
Checks if there is an available update. Accepts options defined below. Returns an instance with an .update
property if there is an available update, otherwise undefined
.
Type: object
Type: object
Required
Type: string
Required
Type: string
Type: number
Default: 1000 * 60 * 60 * 24
(1 day)
How often to check for updates.
Type: boolean
Default: false
Allows notification to be shown when running as an npm script.
Type: string
Default: 'latest'
Which dist-tag to use to find the latest version.
Check update information.
Returns an object
with:
latest
(string) - Latest version.current
(string) - Current version.type
(string) - Type of current update. Possible values: latest
, major
, minor
, patch
, prerelease
, build
.name
(string) - Package name.Convenience method to display a notification message. (See screenshot)
Only notifies if there is an update and the process is TTY.
Type: object
Type: boolean
Default: true
Defer showing the notification to after the process has exited.
Type: string
Default: See above screenshot
Message that will be shown when an update is available.
Available placeholders:
{packageName}
- Package name.{currentVersion}
- Current version.{latestVersion}
- Latest version.{updateCommand}
- Update command.notifier.notify({message: 'Run `{updateCommand}` to update.'});
// Output:
// Run `npm install update-notifier-tester@1.0.0` to update.
Type: boolean
Default: Auto-detect
Include the -g
argument in the default message's npm i
recommendation. You may want to change this if your CLI package can be installed as a dependency of another project, and don't want to recommend a global installation. This option is ignored if you supply your own message
(see above).
Type: object
Default: {padding: 1, margin: 1, textAlignment: 'center', borderColor: 'yellow', borderStyle: 'round'}
(See screenshot)
Options object that will be passed to boxen
.
Users of your module have the ability to opt-out of the update notifier by changing the optOut
property to true
in ~/.config/configstore/update-notifier-[your-module-name].json
. The path is available in notifier.config.path
.
Users can also opt-out by setting the environment variable NO_UPDATE_NOTIFIER
with any value or by using the --no-update-notifier
flag on a per run basis.
The check is also skipped automatically:
NODE_ENV
environment variable is test
)The idea for this module came from the desire to apply the browser update strategy to CLI tools, where everyone is always on the latest version. We first tried automatic updating, which we discovered wasn't popular. This is the second iteration of that idea, but limited to just update notifications.
There are a bunch projects using it:
FAQs
Update notifications for your CLI app
The npm package update-notifier receives a total of 4,649,513 weekly downloads. As such, update-notifier popularity was classified as popular.
We found that update-notifier demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt introduced its new package manager and a serverless registry this week, innovating in a space where npm has stagnated.
Security News
Research
The Socket Research Team uncovered a malicious Python package typosquatting the popular 'fabric' SSH library, silently exfiltrating AWS credentials from unsuspecting developers.
Security News
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.