Dependency Freshness Check for package.json

When a project has sat untouched for a while, its dependencies drift. Some packages gain new major versions with breaking changes, some are deprecated, and a few stop working with newer Node.js releases. Knowing how far behind a project is helps you plan a takeover honestly, before anyone promises a delivery date. Paste a package.json and this tool asks the public npm registry for each package's latest version and deprecation status, straight from your browser.

What it checks

For every entry in dependencies and devDependencies, the tool compares the version range you declared with the latest version published on npm and sorts the result into groups:

• Up to date: your range already includes the latest release.
• Outdated (minor or patch): newer releases exist within the same major version. These are usually safe to take.
• Major behind: the latest release has a higher major version. Expect breaking changes and read the changelog first.
• Deprecated: the maintainers have marked the package or version as deprecated on npm, often with a message naming a replacement.
• Not found: the name is not on the public registry, or the entry points to git, a local path or a workspace.

Reading version ranges

npm uses semantic versioning: MAJOR.MINOR.PATCH. A major bump may break your code, a minor bump adds features, a patch fixes bugs. The symbols in front of a version decide which updates npm install may pick up:

The last row surprises people: below version 1, npm treats each minor bump as possibly breaking, so the caret is stricter.

Why the lockfile matters

package.json lists ranges. The lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) records the exact versions that were actually installed. Without it, two developers running install on different days can get different code. If the repository has no lockfile, generate one and commit it before you change anything else. That gives you a known starting point to go back to.

Because this tool reads package.json, it sees ranges, not installed versions. For installed versions, run npm outdated inside the project, which shows current, wanted and latest side by side.

A safe upgrade order

1. Get a clean baseline. Install from the lockfile, run the build and any tests, and note what already fails.
2. Take patch and minor updates together. Run npm update, rebuild, test and commit.
3. Replace deprecated packages using the replacement named in the deprecation message.
4. Do majors one at a time. Read the release notes or migration guide, upgrade, fix, test and commit before starting the next one.
5. Move related packages as a group. For example react with react-dom and their type packages, or next with eslint-config-next. Mixed versions of a framework family cause confusing errors.
6. Leave the framework major for last unless something else depends on it. It is usually the biggest change.

Committing after each step means a broken build can be traced to a single upgrade and rolled back.

Limitations

• Only npm packages and only the public registry are checked.
• The tool does not run a vulnerability audit. Use npm audit or your git host's dependency alerts for known security issues.
• "Latest" means the version tagged latest on npm. Pre-releases are ignored, and the latest version is not always the right one for your Node.js or framework version.

Results are guidance, not a security audit.

Using the result in a takeover

For owners, a long "major behind" list explains why a developer may quote time for upgrades before new features. For developers, it is one of the first things to run; our guides on assessing a takeover before you commit and your first week on an inherited codebase show where it fits. Apps from AI builders often pin unusual versions; why Lovable, Bolt and v0 apps break in production explains why.

Too far behind to fix alone?

If the project will not even install, see how to finish a half-built app. When you want someone to bring it up to date, post your takeover for free and include this tool's summary so developers can scope the upgrade work.