.gitattributes

@@ -1,2 +1 @@
-* text=auto
-*.js text eol=lf
+* text=auto eol=lf

.github/funding.yml

@@ -0,0 +1,2 @@
+github: sindresorhus
+tidelift: npm/update-notifier

.github/security.md

@@ -0,0 +1,3 @@
+# Security Policy
+
+To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure.

.travis.yml

@@ -1,4 +1,5 @@
 language: node_js
 node_js:
-  - '6'
-  - '4'
+  - '12'
+  - '10'
+  - '8'

check.js

@@ -6,17 +6,23 @@ const options = JSON.parse(process.argv[2]);
 
 updateNotifier = new updateNotifier.UpdateNotifier(options);
 
-updateNotifier.checkNpm().then(update => {
+(async () => {
+	// Exit process when offline
+	setTimeout(process.exit, 1000 * 30);
+
+	const update = await updateNotifier.fetchInfo();
+
 	// Only update the last update check time on success
 	updateNotifier.config.set('lastUpdateCheck', Date.now());
 
 	if (update.type && update.type !== 'latest') {
 		updateNotifier.config.set('update', update);
 	}
 
-	// Call process exit explicitly to terminate the child process
-	// Otherwise the child process will run forever, according to the Node.js docs
+	// Call process exit explicitly to terminate the child process,
+	// otherwise the child process will run forever, according to the Node.js docs
 	process.exit();
-}).catch(() => {
+})().catch(error => {
+	console.error(error);
 	process.exit(1);
 });

index.js

@@ -1,7 +1,7 @@
 'use strict';
-const spawn = require('child_process').spawn;
+const {spawn} = require('child_process');
 const path = require('path');
-const format = require('util').format;
+const {format} = require('util');
 const importLazy = require('import-lazy')(require);
 
 const configstore = importLazy('configstore');
@@ -10,15 +10,19 @@ const semverDiff = importLazy('semver-diff');
 const latestVersion = importLazy('latest-version');
 const isNpm = importLazy('is-npm');
 const isInstalledGlobally = importLazy('is-installed-globally');
+const isYarnGlobal = importLazy('is-yarn-global');
+const hasYarn = importLazy('has-yarn');
 const boxen = importLazy('boxen');
 const xdgBasedir = importLazy('xdg-basedir');
+const isCi = importLazy('is-ci');
+
 const ONE_DAY = 1000 * 60 * 60 * 24;
 
 class UpdateNotifier {
-	constructor(options) {
-		options = options || {};
+	constructor(options = {}) {
 		this.options = options;
 		options.pkg = options.pkg || {};
+		options.distTag = options.distTag || 'latest';
 
 		// Reduce pkg to the essential keys. with fallback to deprecated options
 		// TODO: Remove deprecated options at some point far into the future
@@ -34,12 +38,13 @@ class UpdateNotifier {
 		this.packageName = options.pkg.name;
 		this.packageVersion = options.pkg.version;
 		this.updateCheckInterval = typeof options.updateCheckInterval === 'number' ? options.updateCheckInterval : ONE_DAY;
-		this.hasCallback = typeof options.callback === 'function';
-		this.callback = options.callback || (() => {});
 		this.disabled = 'NO_UPDATE_NOTIFIER' in process.env ||
-			process.argv.indexOf('--no-update-notifier') !== -1;
+			process.env.NODE_ENV === 'test' ||
+			process.argv.includes('--no-update-notifier') ||
+			isCi();
+		this.shouldNotifyInNpmScript = options.shouldNotifyInNpmScript;
 
-		if (!this.disabled && !this.hasCallback) {
+		if (!this.disabled) {
 			try {
 				const ConfigStore = configstore();
 				this.config = new ConfigStore(`update-notifier-${this.packageName}`, {
@@ -48,28 +53,22 @@ class UpdateNotifier {
 					// after the set interval, so not to bother users right away
 					lastUpdateCheck: Date.now()
 				});
-			} catch (err) {
+			} catch (_) {
 				// Expecting error code EACCES or EPERM
-				const msg =
+				const message =
 					chalk().yellow(format(' %s update check failed ', options.pkg.name)) +
 					format('\n Try running with %s or get access ', chalk().cyan('sudo')) +
 					'\n to the local update config store via \n' +
 					chalk().cyan(format(' sudo chown -R $USER:$(id -gn $USER) %s ', xdgBasedir().config));
 
 				process.on('exit', () => {
-					console.error('\n' + boxen()(msg, {align: 'center'}));
+					console.error('\n' + boxen()(message, {align: 'center'}));
 				});
 			}
 		}
 	}
-	check() {
-		if (this.hasCallback) {
-			this.checkNpm()
-				.then(update => this.callback(null, update))
-				.catch(err => this.callback(err));
-			return;
-		}
 
+	check() {
 		if (
 			!this.config ||
 			this.config.get('optOut') ||
@@ -81,6 +80,10 @@ class UpdateNotifier {
 		this.update = this.config.get('update');
 
 		if (this.update) {
+			// Use the real latest version instead of the cached one
+			this.update.current = this.packageVersion;
+
+			// Clear cached information
 			this.config.delete('update');
 		}
 
@@ -95,37 +98,56 @@ class UpdateNotifier {
 			stdio: 'ignore'
 		}).unref();
 	}
-	checkNpm() {
-		return latestVersion()(this.packageName).then(latestVersion => {
-			return {
-				latest: latestVersion,
-				current: this.packageVersion,
-				type: semverDiff()(this.packageVersion, latestVersion) || 'latest',
-				name: this.packageName
-			};
-		});
+
+	async fetchInfo() {
+		const {distTag} = this.options;
+		const latest = await latestVersion()(this.packageName, {version: distTag});
+
+		return {
+			latest,
+			current: this.packageVersion,
+			type: semverDiff()(this.packageVersion, latest) || distTag,
+			name: this.packageName
+		};
 	}
-	notify(opts) {
-		if (!process.stdout.isTTY || isNpm() || !this.update) {
+
+	notify(options) {
+		const suppressForNpm = !this.shouldNotifyInNpmScript && isNpm().isNpmOrYarn;
+		if (!process.stdout.isTTY || suppressForNpm || !this.update || this.update.current === this.update.latest) {
 			return this;
 		}
 
-		opts = Object.assign({isGlobal: isInstalledGlobally()}, opts);
+		options = Object.assign({
+			isGlobal: isInstalledGlobally(),
+			isYarnGlobal: isYarnGlobal()()
+		}, options);
+
+		let installCommand;
+
+		if (options.isYarnGlobal) {
+			installCommand = `yarn global add ${this.packageName}`;
+		} else if (options.isGlobal) {
+			installCommand = `npm i -g ${this.packageName}`;
+		} else if (hasYarn()()) {
+			installCommand = `yarn add ${this.packageName}`;
+		} else {
+			installCommand = `npm i ${this.packageName}`;
+		}
 
-		opts.message = opts.message || 'Update available ' + chalk().dim(this.update.current) + chalk().reset(' → ') +
-			chalk().green(this.update.latest) + ' \nRun ' + chalk().cyan('npm i ' + (opts.isGlobal ? '-g ' : '') + this.packageName) + ' to update';
+		options.message = options.message || 'Update available ' + chalk().dim(this.update.current) + chalk().reset(' → ') +
+			chalk().green(this.update.latest) + ' \nRun ' + chalk().cyan(installCommand) + ' to update';
 
-		opts.boxenOpts = opts.boxenOpts || {
+		options.boxenOptions = options.boxenOptions || {
 			padding: 1,
 			margin: 1,
 			align: 'center',
 			borderColor: 'yellow',
 			borderStyle: 'round'
 		};
 
-		const message = '\n' + boxen()(opts.message, opts.boxenOpts);
+		const message = '\n' + boxen()(options.message, options.boxenOptions);
 
-		if (opts.defer === false) {
+		if (options.defer === false) {
 			console.error(message);
 		} else {
 			process.on('exit', () => {

license

@@ -0,0 +1,9 @@
+Copyright Google
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

package.json

@@ -1,53 +1,63 @@
 {
-  "name": "update-notifier",
-  "version": "2.3.0",
-  "description": "Update notifications for your CLI app",
-  "license": "BSD-2-Clause",
-  "repository": "yeoman/update-notifier",
-  "author": {
-    "name": "Sindre Sorhus",
-    "email": "sindresorhus@gmail.com",
-    "url": "sindresorhus.com"
-  },
-  "engines": {
-    "node": ">=4"
-  },
-  "scripts": {
-    "test": "xo && ava --timeout=20s"
-  },
-  "files": [
-    "index.js",
-    "check.js"
-  ],
-  "keywords": [
-    "npm",
-    "update",
-    "updater",
-    "notify",
-    "notifier",
-    "check",
-    "checker",
-    "cli",
-    "module",
-    "package",
-    "version"
-  ],
-  "dependencies": {
-    "boxen": "^1.2.1",
-    "chalk": "^2.0.1",
-    "configstore": "^3.0.0",
-    "import-lazy": "^2.1.0",
-    "is-installed-globally": "^0.1.0",
-    "is-npm": "^1.0.0",
-    "latest-version": "^3.0.0",
-    "semver-diff": "^2.0.0",
-    "xdg-basedir": "^3.0.0"
-  },
-  "devDependencies": {
-    "ava": "*",
-    "clear-module": "^2.1.0",
-    "fixture-stdout": "^0.2.1",
-    "strip-ansi": "^4.0.0",
-    "xo": "^0.18.2"
-  }
+	"name": "update-notifier",
+	"version": "4.0.0",
+	"description": "Update notifications for your CLI app",
+	"license": "BSD-2-Clause",
+	"repository": "yeoman/update-notifier",
+	"funding": "https://github.com/yeoman/update-notifier?sponsor=1",
+	"author": {
+		"name": "Sindre Sorhus",
+		"email": "sindresorhus@gmail.com",
+		"url": "https://sindresorhus.com"
+	},
+	"engines": {
+		"node": ">=8"
+	},
+	"scripts": {
+		"test": "xo && ava --timeout=20s -s"
+	},
+	"files": [
+		"index.js",
+		"check.js"
+	],
+	"keywords": [
+		"npm",
+		"update",
+		"updater",
+		"notify",
+		"notifier",
+		"check",
+		"checker",
+		"cli",
+		"module",
+		"package",
+		"version"
+	],
+	"dependencies": {
+		"boxen": "^4.2.0",
+		"chalk": "^3.0.0",
+		"configstore": "^5.0.0",
+		"has-yarn": "^2.1.0",
+		"import-lazy": "^2.1.0",
+		"is-ci": "^2.0.0",
+		"is-installed-globally": "^0.3.1",
+		"is-npm": "^4.0.0",
+		"is-yarn-global": "^0.3.0",
+		"latest-version": "^5.0.0",
+		"semver-diff": "^3.1.1",
+		"xdg-basedir": "^4.0.0"
+	},
+	"devDependencies": {
+		"ava": "^2.4.0",
+		"clear-module": "^4.0.0",
+		"fixture-stdout": "^0.2.1",
+		"mock-require": "^3.0.3",
+		"strip-ansi": "^6.0.0",
+		"xo": "^0.25.3"
+	},
+	"xo": {
+		"rules": {
+			"prefer-object-spread": 0
+		}
+	}
 }

readme.md

@@ -15,15 +15,13 @@ Inform users of your package of updates in a non-intrusive way.
 - [About](#about)
 - [Users](#users)
 
-
 ## Install
 
 ```
 $ npm install update-notifier
 ```
 
-
-## Usafe
+## Usage
 
 ### Simple
 
@@ -71,84 +69,103 @@ if (notifier.update) {
 }
 ```
 
-
 ## How
 
 Whenever you initiate the update notifier and it's not within the interval threshold, it will asynchronously check with npm in the background for available updates, then persist the result. The next time the notifier is initiated, the result will be loaded into the `.update` property. This prevents any impact on your package startup performance.
 The update check is done in a unref'ed [child process](https://nodejs.org/api/child_process.html#child_process_child_process_spawn_command_args_options). This means that if you call `process.exit`, the check will still be performed in its own process.
 
 The first time the user runs your app, it will check for an update, and even if an update is available, it will wait the specified `updateCheckInterval` before notifying the user. This is done to not be annoying to the user, but might surprise you as an implementer if you're testing whether it works. Check out [`example.js`](example.js) to quickly test out `update-notifier` and see how you can test that it works in your app.
 
-
 ## API
 
 ### notifier = updateNotifier(options)
 
-Checks if there is an available update. Accepts options defined below. Returns an instance with an `.update` property there is an available update, otherwise `undefined`.
+Checks if there is an available update. Accepts options defined below. Returns an instance with an `.update` property if there is an available update, otherwise `undefined`.
 
 ### options
 
+Type: `object`
+
 #### pkg
 
-Type: `Object`
+Type: `object`
 
 ##### name
 
-*Required*<br>
+*Required*\
 Type: `string`
 
 ##### version
 
-*Required*<br>
+*Required*\
 Type: `string`
 
 #### updateCheckInterval
 
-Type: `number`<br>
+Type: `number`\
 Default: `1000 * 60 * 60 * 24` *(1 day)*
 
 How often to check for updates.
 
-#### callback(error, update)
+#### shouldNotifyInNpmScript
+
+Type: `boolean`\
+Default: `false`
+
+Allows notification to be shown when running as an npm script.
+
+#### distTag
 
-Type: `Function`
+Type: `string`\
+Default: `'latest'`
 
-Passing a callback here will make it check for an update directly and report right away. Not recommended as you won't get the benefits explained in [`How`](#how). `update` is equal to `notifier.update`.
+Which [dist-tag](https://docs.npmjs.com/adding-dist-tags-to-packages) to use to find the latest version.
 
-### notifier.notify([options])
+### notifier.fetchInfo()
+
+Check update information.
+
+Returns an `object` with:
+
+- `latest` _(String)_ - Latest version.
+- `current` _(String)_ - Current version.
+- `type` _(String)_ - Type of current update. Possible values: `latest`, `major`, `minor`, `patch`, `prerelease`, `build`.
+- `name` _(String)_ - Package name.
+
+### notifier.notify(options?)
 
 Convenience method to display a notification message. *(See screenshot)*
 
-Only notifies if there is an update and the process is [TTY](https://nodejs.org/api/process.html#process_tty_terminals_and_process_stdout).
+Only notifies if there is an update and the process is [TTY](https://nodejs.org/api/process.html#process_a_note_on_process_i_o).
 
 #### options
 
-Type: `Object`
+Type: `object`
 
 ##### defer
 
-Type: `boolean`<br>
+Type: `boolean`\
 Default: `true`
 
 Defer showing the notification to after the process has exited.
 
 ##### message
 
-Type: `string`<br>
+Type: `string`\
 Default: [See above screenshot](https://github.com/yeoman/update-notifier#update-notifier-)
 
 Message that will be shown when an update is available.
 
 ##### isGlobal
 
-Type: `boolean`<br>
-Default: `true`
+Type: `boolean`\
+Default: Auto-detect
 
 Include the `-g` argument in the default message's `npm i` recommendation. You may want to change this if your CLI package can be installed as a dependency of another project, and don't want to recommend a global installation. This option is ignored if you supply your own `message` (see above).
 
-##### boxenOpts
+##### boxenOptions
 
-Type: `Object`<br>
+Type: `object`\
 Default: `{padding: 1, margin: 1, align: 'center', borderColor: 'yellow', borderStyle: 'round'}` *(See screenshot)*
 
 Options object that will be passed to [`boxen`](https://github.com/sindresorhus/boxen).
@@ -159,26 +176,35 @@ Users of your module have the ability to opt-out of the update notifier by chang
 
 Users can also opt-out by [setting the environment variable](https://github.com/sindresorhus/guides/blob/master/set-environment-variables.md) `NO_UPDATE_NOTIFIER` with any value or by using the `--no-update-notifier` flag on a per run basis.
 
+The check is also skipped automatically:
+  - on CI
+  - in unit tests (when the `NODE_ENV` environment variable is `test`)
 
 ## About
 
 The idea for this module came from the desire to apply the browser update strategy to CLI tools, where everyone is always on the latest version. We first tried automatic updating, which we discovered wasn't popular. This is the second iteration of that idea, but limited to just update notifications.
 
-
 ## Users
 
 There are a bunch projects using it:
 
 - [npm](https://github.com/npm/npm) - Package manager for JavaScript
 - [Yeoman](http://yeoman.io) - Modern workflows for modern webapps
 - [AVA](https://ava.li) - Simple concurrent test runner
-- [XO](https://github.com/sindresorhus/xo) - JavaScript happiness style linter
+- [XO](https://github.com/xojs/xo) - JavaScript happiness style linter
 - [Pageres](https://github.com/sindresorhus/pageres) - Capture website screenshots
 - [Node GH](http://nodegh.io) - GitHub command line tool
 
-[And 1600+ more…](https://www.npmjs.org/browse/depended/update-notifier)
-
+[And 2700+ more…](https://www.npmjs.org/browse/depended/update-notifier)
 
-## License
+---
 
-[BSD license](http://opensource.org/licenses/bsd-license.php) and copyright Google
+<div align="center">
+	<b>
+		<a href="https://tidelift.com/subscription/pkg/npm-update_notifier?utm_source=npm-update-notifier&utm_medium=referral&utm_campaign=readme">Get professional support for this package with a Tidelift subscription</a>
+	</b>
+	<br>
+	<sub>
+		Tidelift helps make open source sustainable for maintainers while giving companies<br>assurances about security, maintenance, and licensing for their dependencies.
+	</sub>
+</div>

test/fs-error.js

@@ -4,9 +4,8 @@ import test from 'ava';
 let updateNotifier;
 
 test.before(() => {
-	['.', 'configstore', 'xdg-basedir'].forEach(clearModule);
-	// Set configstore.config to something
-	// that requires root access
+	['..', 'configstore', 'xdg-basedir'].forEach(clearModule);
+	// Set configstore.config to something that requires root access
 	process.env.XDG_CONFIG_HOME = '/usr';
 	updateNotifier = require('..');
 });

test/notify.js

@@ -3,40 +3,41 @@ import clearModule from 'clear-module';
 import FixtureStdout from 'fixture-stdout';
 import stripAnsi from 'strip-ansi';
 import test from 'ava';
+import mock from 'mock-require';
 
 const stderr = new FixtureStdout({
 	stream: process.stderr
 });
-let updateNotifier = require('..');
 
-test.before(() => {
-	['.', 'is-npm'].forEach(clearModule);
-	['npm_config_username', 'npm_package_name', 'npm_config_heading'].forEach(name => {
-		delete process.env[name];
-	});
-	process.stdout.isTTY = true;
-	updateNotifier = require('..');
-});
-
-function Control() {
+function Control(shouldNotifyInNpmScript) {
 	this.packageName = 'update-notifier-tester';
 	this.update = {
 		current: '0.0.2',
 		latest: '1.0.0'
 	};
+	this.shouldNotifyInNpmScript = shouldNotifyInNpmScript;
 }
-util.inherits(Control, updateNotifier.UpdateNotifier);
+
+const setupTest = isNpmReturnValue => {
+	['..', 'is-npm'].forEach(clearModule);
+	process.stdout.isTTY = true;
+	mock('is-npm', {isNpmOrYarn: isNpmReturnValue || false});
+	const updateNotifier = require('..');
+	util.inherits(Control, updateNotifier.UpdateNotifier);
+};
 
 let errorLogs = '';
 
 test.beforeEach(() => {
+	setupTest();
 	stderr.capture(s => {
 		errorLogs += s;
 		return false;
 	});
 });
 
 test.afterEach(() => {
+	mock.stopAll();
 	stderr.release();
 	errorLogs = '';
 });
@@ -62,3 +63,31 @@ test('exclude -g argument when `isGlobal` option is `false`', t => {
 	notifier.notify({defer: false, isGlobal: false});
 	t.not(stripAnsi(errorLogs).indexOf('Run npm i update-notifier-tester to update'), -1);
 });
+
+test('shouldNotifyInNpmScript should default to false', t => {
+	const notifier = new Control();
+	notifier.notify({defer: false});
+	t.not(stripAnsi(errorLogs).indexOf('Update available'), -1);
+});
+
+test('suppress output when running as npm script', t => {
+	setupTest(true);
+	const notifier = new Control();
+	notifier.notify({defer: false});
+	t.false(stripAnsi(errorLogs).includes('Update available'));
+});
+
+test('should ouput if running as npm script and shouldNotifyInNpmScript option set', t => {
+	setupTest(true);
+	const notifier = new Control(true);
+	notifier.notify({defer: false});
+	t.true(stripAnsi(errorLogs).includes('Update available'));
+});
+
+test('should not output if current version is the latest', t => {
+	setupTest(true);
+	const notifier = new Control(true);
+	notifier.update.current = '1.0.0';
+	notifier.notify({defer: false});
+	t.false(stripAnsi(errorLogs).includes('Update available'));
+});

test/update-notifier.js

@@ -1,22 +1,28 @@
 import fs from 'fs';
 import test from 'ava';
+import mockRequire from 'mock-require';
+
+mockRequire('is-ci', false);
+
 import updateNotifier from '..';
 
-const generateSettings = options => {
-	options = options || {};
+const generateSettings = (options = {}) => {
 	return {
 		pkg: {
 			name: 'update-notifier-tester',
 			version: '0.0.2'
 		},
-		callback: options.callback || null
+		distTag: options.distTag
 	};
 };
 
 let argv;
 let configstorePath;
 
 test.beforeEach(() => {
+	// Prevents NODE_ENV 'test' default behavior which disables `update-notifier`
+	process.env.NODE_ENV = 'ava-test';
+
 	argv = process.argv.slice();
 	configstorePath = updateNotifier(generateSettings()).config.path;
 });
@@ -29,20 +35,15 @@ test.afterEach(() => {
 	}, 10000);
 });
 
-test('check for update', async t => {
-	const update = await updateNotifier(generateSettings()).checkNpm();
-	t.is(update.current, '0.0.2');
+test('fetch info', async t => {
+	const update = await updateNotifier(generateSettings()).fetchInfo();
+	console.log(update);
+	t.is(update.latest, '0.0.2');
 });
 
-test.cb('check for update with callback', t => {
-	t.plan(1);
-
-	updateNotifier(generateSettings({
-		callback: () => {
-			t.pass();
-			t.end();
-		}
-	}));
+test('fetch info with dist-tag', async t => {
+	const update = await updateNotifier(generateSettings({distTag: '0.0.3-rc1'})).fetchInfo();
+	t.is(update.latest, '0.0.3-rc1');
 });
 
 test('don\'t initialize configStore when NO_UPDATE_NOTIFIER is set', t => {
@@ -56,3 +57,9 @@ test('don\'t initialize configStore when --no-update-notifier is set', t => {
 	const notifier = updateNotifier(generateSettings());
 	t.is(notifier.config, undefined);
 });
+
+test('don\'t initialize configStore when NODE_ENV === "test"', t => {
+	process.env.NODE_ENV = 'test';
+	const notifier = updateNotifier(generateSettings());
+	t.is(notifier.config, undefined);
+});