VueCraft NPM

Inspecting Packages ​

Read-only commands, safe to run any time — none of these change anything.

list ​

A table of every discovered package. Full summary by default: local version, branch, git status (clean/dirty), whether the current version is tagged, whether that tag has a release, whether the npm registry matches (or the registry version if it doesn't, or "unpublished"), and how many other local packages reference it with a now-stale dependency range (see doctor).

bash
polyrepo list [options]

The git/tag/release/npm checks run in parallel across packages, but they're still real network calls (tag, release, and registry — three per package), so a full list across many packages takes a few seconds rather than being instant. alias: ls

Example output (truncated — a real run covers every discovered package):

Package                   Version  Branch  Git    Tag      Release  npm  Deps
------------------------  -------  ------  -----  -------  -------  ---  ----
color-value-tools         1.1.12   master  clean  v1.1.12  ✓        ✓    ✓
css-magic-gradient        1.2.14   master  clean  v1.2.14  ✓        ✓    ✓
os-detect                 2.1.5    master  clean  v2.1.5   ✓        ✓    ✓
…

Options ​

--quick ​

Skip the tag/release/npm/dependency checks — just version, branch, and git status. No network calls.

--path ​

Add a Path column (right after Package) showing each package's location on disk.

--output <path> ​

Also save the table to this file, in addition to printing it — for sending the data somewhere.

--format <md|json|csv|html|txt> ​

File format for --output. Guessed from the file extension if omitted (.json → json, .md/.markdown → markdown, .csv → csv, .html/.htm → html, anything else → plain text). In JSON, a cell that's just a ✓/✗ checkmark becomes a real true/false; anything carrying more information than a plain yes/no (an outdated registry version, a stale-dep count, clean/dirty) stays text.

Example:

bash
polyrepo list --quick
polyrepo list --output packages.json

outdated ​

One table of outdated dependencies across every package, instead of running npm outdated in each repo by hand.

bash
polyrepo outdated [options]

Runs in parallel across packages, with a blank line between each package's rows for readability, and a summary line above the table (N dependencies outdated across M package(s), K of them major version behind). The Latest column is colored by how far behind it is — red for a major bump, yellow for minor, dim for patch.

Example output:

15 dependencies outdated across 2 package(s), 3 of them major version behind

Package            Dependency              Current  Wanted   Latest
-----------------  ----------------------  -------  -------  -------
color-value-tools  @types/node             26.4.1   25.9.5   26.4.1
color-value-tools  typescript              7.0.2    5.9.3    7.0.2
color-value-tools  vitest                  2.1.9    2.1.9    5.0.0

os-detect          @playwright/test        1.61.0   1.63.0   1.63.0
os-detect          @types/node             25.5.0   25.9.5   26.4.1
os-detect          @types/react            19.2.14  19.2.18  19.2.18
os-detect          eslint                  10.1.0   10.10.0  10.10.0
os-detect          jest                    30.3.0   30.5.1   30.5.1
os-detect          jest-environment-jsdom  30.3.0   30.5.1   30.5.1
os-detect          prettier                3.8.1    3.9.6    3.9.6
os-detect          react                   19.2.4   19.2.8   19.2.8
os-detect          ts-jest                 29.4.11  29.4.12  29.4.12
os-detect          typescript              6.0.2    6.0.3    7.0.2
os-detect          typescript-eslint       8.59.4   8.69.0   8.69.0
os-detect          vue                     3.5.31   3.5.42   3.5.42

vitest on color-value-tools, and @types/node/typescript on os-detect, are all in red (major version behind) — the rest are yellow (minor) or dim (patch, or already matching Latest with just a lower Wanted).

Options ​

--packages <a,b,c> ​

Only check these packages.

Example:

bash
polyrepo outdated --packages vue-toast-kit,os-detect

audit ​

One table of npm security vulnerabilities across every package, instead of running npm audit in each repo by hand.

bash
polyrepo audit [options]

Runs in parallel across packages, with a blank line between each package's rows for readability (same as outdated), and a summary line above the table (N vulnerabilities across M package(s), K of them critical/high severity). Rows are sorted by severity within each package. The Severity column is colored — bold red for critical, red for high, yellow for moderate, dim for low/info. Fix available says whether a fix exists, and names the package/version it would resolve to when that's a semver-major bump of a top-level dependency.

Example output:

9 vulnerabilities across 1 package(s), 6 of them critical/high severity

Package    Dependency       Severity  Type        Fix available
---------  ---------------  --------  ----------  -------------
os-detect  brace-expansion  high      transitive  yes
os-detect  browserslist     high      transitive  yes
os-detect  js-yaml          high      transitive  yes
os-detect  nanoid           high      transitive  yes
os-detect  postcss          high      transitive  yes
os-detect  ws               high      transitive  yes
os-detect  @humanfs/node    moderate  transitive  yes
os-detect  @babel/core      low       transitive  yes
os-detect  esbuild          low       transitive  yes

All nine here are transitive (devDependency-tree) findings with a fix already available — polyrepo audit only reports what npm audit finds, it doesn't run npm audit fix for you. Packages with nothing found don't add any rows; if nothing's found anywhere, it says so instead of printing an empty table.

Options ​

--packages <a,b,c> ​

Only check these packages.

Example:

bash
polyrepo audit
polyrepo audit --packages os-detect

prs ​

One table of every open pull/merge request across every package.

bash
polyrepo prs [options]

Runs gh pr list (GitHub repos) or glab mr list (GitLab repos) for every package in parallel — useful after an interrupted bump run, to see at a glance which packages still have one open that needs merging by hand.

Example output — with something actually open (one leftover bump PR waiting on os-detect, and two on vue-toast-kit — one of them still a draft):

Package        PR/MR   Title                                       Branch               Status
-------------  ------  ------------------------------------------  -------------------  ------
os-detect      PR #21  chore: bump version to 2.1.6                2.1.6-version-bump

vue-toast-kit  PR #14  chore: bump version to 1.0.8                1.0.8-version-bump
vue-toast-kit  PR #15  Add dark mode support for toast container   dark-mode-support    draft

The chore: bump version to ... titles are the ones bump itself opens; PR #15 here is an unrelated PR someone opened by hand, still in draft — prs shows both the same way, it doesn't care who or what created it. On a GitLab repo the same row would read MR #21 instead — the label comes from whichever host that particular repo is actually on, a mixed folder shows both in the same table.

When nothing's open, it says so instead of printing an empty table:

No open pull/merge requests.

Options ​

--packages <a,b,c> ​

Only check these packages.

Example:

bash
polyrepo prs