Package Managers

ripen supports four package managers and automatically detects which one your project uses.

Support

Package ManagerProjectsGlobal
npm✅✅
pnpm✅✅
yarn✅✅
bun✅❌

Note: Bun does not support bun outdated --json, so global mode is not available for bun.

Detection

ripen determines your package manager by checking for lock files in this order:

  1. bun.lock or bun.lockb → Bun
  2. pnpm-lock.yaml or pnpm-workspace.yaml → pnpm
  3. yarn.lock → Yarn
  4. package-lock.json → npm

If no lock file is found, ripen defaults to npm.

How It Works

Projects (Local Mode)

For local projects, ripen reads your package.json directly and queries the npm registry to check for newer versions. This means it works the same way regardless of which package manager you use — no outdated CLI commands are involved.

  1. Reads dependencies and devDependencies from package.json
  2. Fetches the latest version for each package from registry.npmjs.org
  3. Compares versions and shows only packages with available updates

This approach is fast, reliable, and works with all four package managers.

Global Mode

For global packages (ripen -g), ripen shells out to each package manager's outdated command:

  • npm outdated --global --json
  • pnpm outdated --global --json
  • yarn outdated --global --json

ripen checks npm, pnpm, and yarn in parallel, then combines the results into a single list. This lets you manage all your global tools from one interface regardless of which package manager installed them.

Version Prefix Handling

ripen preserves your version range prefixes. If your package.json uses ^1.0.0, the update will maintain the ^ prefix. Same for ~ and exact versions.

Next Steps