Upgrade pinned NPM dependencies

npm_upgrade.sh

#!/usr/bin/env bash
#shellcheck disable=SC2155
set -euo pipefail

# upgrade outdated pinned dependencies and commit the changes
npm_upgrade() {
  local dry_run=false
  local prod_only=false
  local help=false
  local help_msg="npm_upgrade

USAGE:
  npm_upgrade [-d|--dry-run] [-p|--prod-only] [-h|--help]

OPTIONS:
  -d, --dry-run    print the commands that would be run instead of running them (default: false)
  -p, --prod-only  only upgrade prod dependencies (default: false)
  -h, --help       display this help message and exit"

  for arg in "$@" ; do
    case $arg in
      -d|--dry-run)
        dry_run=true ;;
      -p|--prod-only)
        prod_only=true ;;
      -h|--help)
        help=true ;;
    esac
  done

  if [[ $help == true ]] ; then
    echo "$help_msg"
    return 0
  fi

  local outdated_json=$(npm outdated --json)

  # exit early
  if [[ $(echo "$outdated_json" | jq -r 'length') == 0 ]] ; then
    return 0
  fi

  local pkg_json=$(cat package.json)
  local deps_json=$(echo "$pkg_json" | jq -r '.dependencies')
  local dev_deps_json=$(echo "$pkg_json" | jq -r '.devDependencies')

  local outdated_deps=()
  local outdated_dev_deps=()
  local message=''

  # build the lists of outdated dependencies
  local outdated_packages=$(echo "$outdated_json" | jq -r 'keys | .[]')
  for pkg in $outdated_packages ; do
    local pkg_obj=$(echo "$outdated_json" | jq -r ".[\"$pkg\"]")
    local current=$(echo "$pkg_obj" | jq -r '.current')

    # you probably ran this immediately after cloning
    if [[ $current == null ]] ; then
      echo 'npm_upgrade: run `npm install`' >&2
      return 1
    fi

    local latest=$(echo "$pkg_obj" | jq -r '.latest')
    local result="${pkg}@${latest}"

    local is_dep=$(echo "$deps_json" | jq -r "has(\"$pkg\")")
    local is_dev_dep=$(echo "$dev_deps_json" | jq -r "has(\"$pkg\")")

    message+="$result"$'\n'

    if [[ $is_dep == true ]] ; then
      outdated_deps+=("$result")
    fi

    if [[ $prod_only != true && $is_dev_dep == true ]] ; then
      outdated_dev_deps+=("$result")
    fi
  done

  # print the commands that would be run instead of running them
  if [[ $dry_run == true ]] ; then
    [[ ${#outdated_deps[@]} -gt 0 ]] && echo "npm install --save-prod --save-exact ${outdated_deps[*]}"
    [[ ${#outdated_dev_deps[@]} -gt 0 ]] && echo "npm install --save-dev --save-exact ${outdated_dev_deps[*]}"
    # return the number of outdated dependencies
    return $(( ${#outdated_deps[@]} + ${#outdated_dev_deps[@]} ))
  fi

  # if there are outdated dependencies, upgrade them
  if [[ ${#outdated_deps[@]} -gt 0 ]] ; then
    npm install --save-prod --save-exact "${outdated_deps[@]}"
  fi

  # if there are outdated devDependencies, upgrade them
  if [[ ${#outdated_dev_deps[@]} -gt 0 ]] ; then
    npm install --save-dev --save-exact "${outdated_dev_deps[@]}"
  fi

  # commit
  if git rev-parse --is-inside-work-tree &>/dev/null ; then
    if [[ -n $(git status --porcelain) ]] ; then
      # this doesn't check for other unstaged changes
      # so only run it when the tree is clean
      git add package.json package-lock.json
      git commit -m 'chore: upgrade dependencies' -m "$message"
    fi
  fi
}

npm_upgrade "$@"

This is a script I put together mostly for some code golf on a lazy Saturday. For real projects you should use something like Dependabot or Renovate.