inupv1.7.0 · interactive dependency upgrader
Your lockfile is nine months behind and you don't know which part is dangerous.
inup reads every workspace in one pass and shows the drift per package — with the advisory and the release notes attached to the bump, not to a separate tab. One command for npm, yarn, pnpm & bun.
or install: npm i -g inup · pnpm add -g inup · yarn global add inup · bun add -g inup
the picker
The picker knows more than outdated does
Every feature is a keystroke away — no flags to remember, no re-runs.
Audit before you upgrade
Known vulnerabilities appear next to each package, cross-referenced against the bump — so you know whether it actually clears the advisory.
Search the picker
Filter hundreds of workspace dependencies as you type. / to search, Esc clears.
- dpo
Live dependency-type toggles
Show or hide dev, peer and optional dependencies on the fly — instead of restarting with different flags.
Changelogs in the terminal
Read release notes inline before selecting a major. No browser tab, no guessing what changed.
Bulk select, precisely
Select every safe in-range update with one key, or everything including majors — then deselect the risky ones.
Range or latest, per package
Cycle each package between no upgrade, the in-range bump and the latest major. Mixed strategies in one pass.
monorepos
pnpm catalogs, without ceremony
inup discovers every workspace in one pass. Dependencies declared ascatalog: are resolved from pnpm-workspace.yamland upgraded right there — comments and formatting preserved, not rewritten.
Private registries work exactly like npm's own resolution: scoped registries and credentials from your project, user and global.npmrc, including ${ENV_VAR} expansion.
# comments survive the upgrade
catalog:
# pinned for the design system
react: "18.3.1" → "19.1.0"
vue: "^3.5.13"# gate the build on outdated deps
inup --check
✗ 3 packages behind · 1 advisory
# structured report for dashboards
inup --json | jq '.summary'
# apply safe in-range bumps + install
inup --apply --target minorautomation
Headless in CI, by default
When stdout isn't a TTY or $CI is set, inup never opens the UI — it reports. --check and --json are read-only, and JSON output carries a schemaVersion so agents can pin to a known shape.
The GitHub Action runs on a schedule and maintains one rolling PR with safe upgrades applied — re-runs update the same PR.
comparison
How inup compares
Honest marks — including the rows where the others win. Verified against each tool's docs on 2026-07-09.
"PM built-ins" = yarn upgrade-interactive,pnpm update -i, bun update -i,deno outdated -i — each works with its own package manager only.
no telemetry
Try it on your messiest repo
No tracking, no data collection. Metadata comes straight from the npm registry and changelogs from GitHub. MIT licensed — read the source.