Allow filtering/rejecting specific version (range) of dependency
Author: remypar5Created Aug 20, 2025Updated Sep 12, 2026
Labelsenhancement
- I have searched for similar issues
Feature Request
When rejecting (or filtering), I would like to be able to specify a version (or range) of the package. E.g. reject updating a to [email protected] which is known to contain malicious code. Or @mui/*@>=5.0.0 because my framework (Backstage) doesn't 5 and higher. The reasons don't really matter for this request.
With the current API this is possible by passing a function to reject but it would help us so much if it were to be handled by ncu itself.
.ncurc:
module.exports = {
reject: [
'@backstage/*', // managed in a different process
'[email protected]', // Malicious
'@mui/*@>=5.0.0', // Major version not supported by framework
],
}
Source: raineorshine/npm-check-updates