Allow filtering/rejecting specific version (range) of dependency

Author: remypar5Created Aug 20, 2025Updated Sep 12, 2026
Labelsenhancement

Feature Request

When rejecting (or filtering), I would like to be able to specify a version (or range) of the package. E.g. reject updating a to [email protected] which is known to contain malicious code. Or @mui/*@>=5.0.0 because my framework (Backstage) doesn't 5 and higher. The reasons don't really matter for this request.

With the current API this is possible by passing a function to reject but it would help us so much if it were to be handled by ncu itself.

.ncurc:

javascript
module.exports = {
  reject: [
    '@backstage/*', // managed in a different process
    '[email protected]', // Malicious
    '@mui/*@>=5.0.0', // Major version not supported by framework
  ],
}

Source: raineorshine/npm-check-updates