# lpm outdated (/docs/packages/outdated)



```bash
lpm outdated
```

Compares every entry in `package.json > dependencies` and `package.json > devDependencies` against the registry and prints the ones with newer versions available. Read-only — never modifies anything.

## Example output [#example-output]

```text
Section            Package                            Current      Wanted       Latest
dependencies       react                              18.2.0       18.3.1       19.0.0
dependencies       zod                                4.3.5        4.3.6        4.4.0
devDependencies    typescript                         5.4.0        5.6.2        5.7.0
```

A row appears when the installed direct dependency version (from `lpm.lock`) differs from the newest version currently installable under the active minimum release age policy. `wanted` is the newest installable version that still satisfies the declared range; `latest` is the newest installable version overall. Fresh direct dependency versions inside the cooldown window are ignored until they mature, matching [`lpm upgrade`](/docs/packages/upgrade) and [`lpm install`](/docs/packages/install).

## Ecosystem scope [#ecosystem-scope]

By default, `lpm outdated` checks both `@lpm.dev/*` packages and npm packages whose lockfile source can be checked without disclosing a private name to a new registry.

```bash
lpm outdated                     # both ecosystems (default)
lpm outdated --registry-only=lpm # @lpm.dev only — useful when npm is rate-limiting or offline
```

`--registry-only=all` is the explicit form of the default.

## Acting on the report [#acting-on-the-report]

[`lpm upgrade`](/docs/packages/upgrade) applies the report for `@lpm.dev/*` packages and for npm packages whose existing `lpm.lock` entry records either public npm or the configured LPM.dev Registry proxy as the source. That keeps the common flow as:

```bash
lpm outdated
lpm upgrade -y
```

For one-off manual bumps, use `lpm install` with the spec you want:

```bash
lpm install zod@latest
lpm install react@^19            # explicit range
```

Packages without a recorded public npm or LPM.dev Registry-proxy source are still skipped instead of being queried against `registry.npmjs.org`. Run `lpm install` first so the source is captured in `lpm.lock`, then rerun `lpm outdated` or `lpm upgrade`.

## JSON output [#json-output]

```bash
lpm outdated --json
```

Emits a schema-versioned envelope with `schema_version`, `success`, `count`, `outdated_count`, and a `packages[]` array. Each row carries:

| Field            | Meaning                                                                                                         |
| ---------------- | --------------------------------------------------------------------------------------------------------------- |
| `schema_version` | JSON contract version for the envelope. Current value: `2`                                                      |
| `name`           | Package name                                                                                                    |
| `current`        | Version resolved in `lpm.lock`, or `"?"` if the lockfile is missing                                             |
| `wanted`         | The newest installable version that satisfies the declared range, or `null` when nothing published satisfies it |
| `wanted_range`   | The raw declared spec from `package.json` (for example `"^4.3.0"`)                                              |
| `latest`         | The newest installable version on the registry, regardless of range                                             |
| `section`        | Which dependency map produced the row: `dependencies` or `devDependencies`                                      |
| `outdated`       | `true` when `current` differs from `latest`                                                                     |

When `lpm outdated` skips non-`@lpm.dev/*` packages because they do not have recorded public npm or LPM.dev Registry-proxy source attribution in `lpm.lock`, the envelope also includes `skipped_private` and `skipped_private_reason`.

Registry lookup failures are not silently skipped. In human mode, LPM CLI lists the packages it could not check and exits non-zero. In `--json` mode, the envelope keeps any successfully checked rows, sets `success: false`, adds `unresolved_count` and `unresolved[]` (`name`, `section`, `reason`), then exits with code 1.

## Flags [#flags]

| Flag                         | Effect                                              |
| ---------------------------- | --------------------------------------------------- |
| `--registry-only <all\|lpm>` | Limit checks to a single ecosystem (default: `all`) |

Plus the [global flags](/docs/commands#global-flags) — `--json` is especially useful for scripting.

## See also [#see-also]

* [`lpm upgrade`](/docs/packages/upgrade) — apply the updates surfaced by `lpm outdated`
* [`lpm audit`](/docs/packages/audit) — check for vulnerable versions you should bump