Dependency Update Checker: npm, pip & Outdated Package Guide

Checking Outdated npm Packages

npm outdated gives you a clear picture of what is behind. Use npm-check-updates to automatically update your package.json to the latest compatible versions.

# Check outdated packages
npm outdated
# Output:
# Package         Current  Wanted  Latest  Location
# react           17.0.2   17.0.2  18.2.0  my-app
# typescript       4.9.5    4.9.5   5.3.2  my-app
# eslint           7.32.0   7.32.0  8.55.0  my-app

# Update to semver-compatible versions (respects ^ and ~ in package.json)
npm update

# Check what npm-check-updates would change (dry run)
npx npm-check-updates

# Apply all updates to package.json (then npm install to apply)
npx npm-check-updates -u && npm install

# Update only patch and minor (skip major version bumps)
npx npm-check-updates --target minor -u && npm install

# Check for security vulnerabilities separately
npm audit
npm audit fix             # auto-fix low-risk vulnerabilities
npm audit fix --force     # also fix breaking-change security fixes

Python Dependency Auditing

For Python projects, combine pip list --outdated for a quick overview with pip-audit for security scanning. Poetry and pip-tools users have dedicated commands that maintain lockfile integrity.

# Check outdated packages
pip list --outdated

# Interactive update tool (prompts for each package)
pip install pip-review
pip-review --interactive    # review each update
pip-review --auto           # update everything automatically

# Security-focused: check for known CVEs
pip install pip-audit
pip-audit                   # scan for vulnerabilities
pip-audit --fix             # auto-upgrade vulnerable packages

# Poetry users
poetry show --outdated
poetry update               # update to latest within constraints
poetry update requests      # update specific package

# pip-tools: regenerate lockfile from high-level requirements
pip install pip-tools
pip-compile requirements.in  # produces requirements.txt with pinned versions
pip-sync requirements.txt    # sync venv to exactly match lockfile

Dependabot & Renovate Configuration

Automate dependency updates entirely. Dependabot is the zero-config choice for GitHub. Renovate gives you fine-grained control — grouping packages, automerge rules, and custom schedules.

# .github/dependabot.yml — Dependabot configuration
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    groups:
      eslint:
        patterns: ["eslint*", "@typescript-eslint/*"]
    ignore:
      - dependency-name: "some-legacy-package"
        versions: [">=2.0.0"]

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"

# renovate.json — Renovate Bot configuration (more powerful)
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:base"],
  "automerge": true,
  "automergeType": "pr",
  "packageRules": [
    {
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    },
    {
      "matchUpdateTypes": ["major"],
      "automerge": false,
      "labels": ["breaking-change"]
    },
    {
      "matchPackagePatterns": ["^react"],
      "groupName": "React packages"
    }
  ]
}

Major vs Minor Update Risk Assessment