lpm outdated

Check which direct dependencies have newer versions available before you plan an upgrade.

lpm outdated [OPTIONS]

Quickstart

lpm outdated
lpm outdated --json

The terminal table shows outdated dependencies. JSON includes every successfully checked dependency, including packages that are current.

The command preserves project files and installed packages. Each invocation revalidates registry metadata and can update local caches.

There is no outdated block in lpm.json.

Read the columns

Section            Package       Current      Wanted       Latest
dependencies       react         18.2.0       18.3.1       19.0.0
devDependencies    typescript    5.4.0        5.9.3        5.9.3

A dependency is outdated if Wanted or Latest is greater than Current. A newer prerelease on a declared next tag therefore appears.

Latest does not mean the greatest published version. A maintainer can move the tag backward while newer versions remain available.

If neither candidate exceeds Current, the dependency is current. A registry rollback alone does not report an update.

If Latest is lower and no eligible release satisfies a non-exact range, Wanted retains Current when Current still matches that range. This fallback uses the lockfile without requiring that version to remain published or pass the release-age policy.

Registry candidates pass the release-age policy. The report does not evaluate engine requirements, platform filters, overrides, peer compatibility, or security verdicts.

Which dependencies are checked?

LPM CLI works with npm, the LPM.dev Registry, and private registries. Outdated uses recorded sources to avoid disclosing private package names.

The command reads the nearest package.json at or above the current directory, as lpm install does, and prints the directory it chose when it is not the current one. In a workspace member, it uses that member's records from the shared root lockfile.

It checks dependencies, devDependencies, and optionalDependencies. Optional declarations take precedence over runtime declarations. Runtime declarations take precedence over development declarations.

The report excludes transitive dependencies and standalone peer declarations. There is no package selector, global mode, or workspace-wide flag.

Eligible metadata sources are:

• Packages named @lpm.dev/*.
• npm packages recorded as public npm or configured LPM.dev Registry proxy installs.

Other npm packages appear in skipped_private. Local paths, Git sources, tarballs, workspace references, and JSR references appear in skipped_non_registry.

A skipped dependency does not make the command fail. A successful report therefore does not guarantee coverage of every declaration.

Aliases and catalogs

Outdated checks the registry package behind an npm: alias and reports its local dependency name. Catalog references use the owning catalog's declaration.

{
  "dependencies": {
    "strip-ansi-cjs": "npm:strip-ansi@^6.0.0",
    "react": "catalog:"
  },
  "catalogs": {
    "default": {
      "react": "^18.0.0"
    }
  }
}

lpm outdated --json

The wanted_range field retains the original alias or catalog: text. A declared latest tag follows that tag for direct dependencies, aliases, and catalogs.

Release-age configuration

Outdated uses the project's minimum release age:

{
  "lpm": {
    "minimumReleaseAge": 86400,
    "minimumReleaseAgeExclude": ["@my-org/*"],
    "minimumReleaseAgePolicy": "strict"
  }
}

minimumReleaseAge is a duration in seconds. minimumReleaseAgeExclude exempts matching package names. Outdated still checks only direct dependencies with the strict policy.

When the latest release is too recent, the Latest column uses an eligible version at or below that tag. Without a latest tag, it uses the greatest eligible version.

Version ranges also exclude releases inside the age window. An exact pin or named tag that selects a blocked release produces an unresolved result.

Outdated has no one-run release-age override flag.

Examples

Check one workspace member

cd packages/web
lpm outdated

Inspect upgrades before applying them

lpm outdated
lpm upgrade react -y --dry-run --json
lpm upgrade react -y

lpm upgrade has its own version-selection rules. Its plan can differ from the Wanted column.

For a catalog dependency, edit the owning catalog, then run lpm install.

Fail CI when checked dependencies are outdated

set -e
lpm outdated --json > outdated.json
jq -e '.success and .outdated_count == 0' outdated.json

Outdated returns zero after a successful check, even if newer versions exist. The jq check makes those versions fail the job.

For complete coverage, also inspect skipped_private and skipped_non_registry.

Recover from an incomplete report

If a public dependency lacks a recorded source or current version, refresh the project first:

lpm install
lpm outdated

Private registries remain outside this report's supported metadata routes.

A missing current version, unavailable tag, or registry failure produces an unresolved dependency. An unsatisfied range also fails unless the rollback fallback applies.

The command retains other successful rows and exits with code 1.

If a lockfile is malformed or unsupported, the command stops with that error. A project without direct dependencies returns an empty report before it reads the lockfile.

JSON output

lpm outdated --json > outdated.json

The current envelope uses schema_version: 2. It includes success, count, outdated_count, and packages.

count counts successful rows. outdated_count counts successful rows with outdated: true. Current and Wanted are concrete versions on successful rows.

An incomplete lookup result sets success: false. It adds error, error_code, unresolved_count, and unresolved rows with name, section, and reason.

Skipped categories include their name arrays, counts, and reasons when present. Configuration or lockfile errors can return the standard error envelope before any rows exist.

Flags

See the global flags for shared options.

See also

• lpm upgrade — preview and apply dependency upgrades.
• lpm install — update installed packages and lockfile records.
• lpm audit — check known vulnerabilities.
• Catalogs — share dependency declarations.