Which problem is this feature request solving?
update-notifier pulls 23 packages into the CLI's dependency tree purely to check whether a newer version has been published. For a tool installed as widely as this one, that is 23 more packages to resolve, audit and trust, in service of one request to the registry and a box drawn on stderr.
Describe the solution you'd like
Replace it with nano-update-notifier, which implements the same public API — same options, same notifier.update shape, same suppression rules — on Node.js built-ins alone, with no runtime dependencies. Types ship with the package, so @types/update-notifier can go as well.
I have the change prepared and verified against main:
- One import in
bin/run.js, two entries in package.json.
- 23 packages removed from the lockfile, 1 added:
@pnpm/config.env-replace, @pnpm/network.ca-file, @pnpm/npm-conf, @types/configstore, @types/update-notifier, config-chain, configstore, deep-extend, escape-goat, global-directory, is-in-ci, is-installed-globally, is-npm, ky, latest-version, package-json, proto-list, pupa, rc, registry-auth-token, registry-url, update-notifier, xdg-basedir.
npm run test:unit passes 423/423, identical to the same run on main including the 5 pre-existing errors from exec-fetcher downloads.build, typecheck, lint and format:check are all clean.- The rendered notification is unchanged. I captured the full output of
bin/run.js with a seeded update under both libraries and diffed it: byte for byte identical, including the ⬥ title, the OSC 8 hyperlink on "release notes", the inverse truecolour install command, and the #28b5ac border.
Compatibility is held by differential test suites that run update-notifier, boxen, semver and string-width as oracles: the full box option matrix, the notification rendering with colour enabled, and fuzzed version comparison. The package is published from a GitHub Actions release with provenance.
The branch is ready at HeversonSilva-gif/cli:deps/nano-update-notifier if you would like to see the diff.
Two things worth raising before any pull request:
.kodiak.toml shows dependencies here are managed by Renovate. A hand-swapped dependency sits outside that flow, and I don't know whether you would want Renovate taught about the replacement.- Disclosure: I wrote
nano-update-notifier. That is exactly why I am opening an issue rather than dropping a pull request on you — CONTRIBUTING asks for discussion first, and a proposal to adopt my own package deserves it more than most. If this is not something you want to take on, saying so costs you nothing and I will not push it.
Which problem is this feature request solving?
update-notifierpulls 23 packages into the CLI's dependency tree purely to check whether a newer version has been published. For a tool installed as widely as this one, that is 23 more packages to resolve, audit and trust, in service of one request to the registry and a box drawn on stderr.Describe the solution you'd like
Replace it with
nano-update-notifier, which implements the same public API — same options, samenotifier.updateshape, same suppression rules — on Node.js built-ins alone, with no runtime dependencies. Types ship with the package, so@types/update-notifiercan go as well.I have the change prepared and verified against
main:bin/run.js, two entries inpackage.json.@pnpm/config.env-replace,@pnpm/network.ca-file,@pnpm/npm-conf,@types/configstore,@types/update-notifier,config-chain,configstore,deep-extend,escape-goat,global-directory,is-in-ci,is-installed-globally,is-npm,ky,latest-version,package-json,proto-list,pupa,rc,registry-auth-token,registry-url,update-notifier,xdg-basedir.npm run test:unitpasses 423/423, identical to the same run onmainincluding the 5 pre-existing errors fromexec-fetcherdownloads.build,typecheck,lintandformat:checkare all clean.bin/run.jswith a seeded update under both libraries and diffed it: byte for byte identical, including the⬥title, the OSC 8 hyperlink on "release notes", the inverse truecolour install command, and the#28b5acborder.Compatibility is held by differential test suites that run
update-notifier,boxen,semverandstring-widthas oracles: the full box option matrix, the notification rendering with colour enabled, and fuzzed version comparison. The package is published from a GitHub Actions release with provenance.The branch is ready at
HeversonSilva-gif/cli:deps/nano-update-notifierif you would like to see the diff.Two things worth raising before any pull request:
.kodiak.tomlshows dependencies here are managed by Renovate. A hand-swapped dependency sits outside that flow, and I don't know whether you would want Renovate taught about the replacement.nano-update-notifier. That is exactly why I am opening an issue rather than dropping a pull request on you — CONTRIBUTING asks for discussion first, and a proposal to adopt my own package deserves it more than most. If this is not something you want to take on, saying so costs you nothing and I will not push it.