npm

What Teire readsCopy Anchor Link

Every directory with a package.json and a lockfile, plus the root. Workspaces resolve per importer: pnpm importers, npm packages, Yarn workspaces, Berry @workspace:, Bun workspaces. It reads dependencies, devDependencies, optionalDependencies and peerDependencies, and resolves npm: aliases to the real package.

Your own rules hold:

• npm overrides, pnpm.overrides and Yarn resolutions pin a version.
• Release-age gates from pnpm minimumReleaseAge, .npmrc min-release-age, .yarnrc.yml npmMinimalAgeGate and bunfig.toml stretch the cooldown. Teire uses the longest gate that applies.
• @types/node never goes above your Node major (from Volta, .nvmrc, .node-version or engines.node).

How breaks are foundCopy Anchor Link

For a major, Teire walks the package's bundled .d.ts files, or @types/<name> on the same major, or its exports when there are no types. It compares the old version with the new and records:

• removed exports and members,
• calls with too few or too many arguments,
• properties that became required,
• deep imports through exports that no longer resolve.

A changed type is an annotation, not a break.

Your code is then type-checked against the installed version. A site counts only where the checker resolves it to the package: a method with the same name on your own class doesn't count. Every way your code reaches the package is followed: import, re-exports, import x = require(), require() and import(). A reference the checker can't follow (a require in a .ts file without Node's types, a package name built at runtime) is unresolved, so the verdict stays inconclusive instead of claiming the package is unused.

npm and PyPI advisories don't name the vulnerable functions (neither OSV nor GitHub's advisory database carries them for these ecosystems), so an advisory there says package present: the vulnerable version is installed, and use can't be ruled out.

How it upgradesCopy Anchor Link

The version range in package.json is edited as text, keeping its style (^, ~, exact). For pnpm catalog: entries, the edit goes into pnpm-workspace.yaml. Then the lockfile alone is regenerated in the sandbox:

A transitive security fix first tries an in-range update (pnpm update, yarn up -R, npm update), then an override.

Deterministic codemods apply on npm: a removed deep import rewritten to the path the migration note names, or a renamed call, only where the target proves the new name exists.

How it verifiesCopy Anchor Link

Install: npm ci, pnpm install --frozen-lockfile, yarn install --frozen-lockfile (v1) or yarn install --immutable --mode=skip-build (Berry), bun install --frozen-lockfile. No lifecycle or build script runs: --ignore-scripts, or Berry's --mode=skip-build.

The checks come from your CI first: workflow steps that run a package script for typecheck, build or test. Next come your scripts (typecheck, type-check, test, test:unit…). Last come the defaults: tsc --noEmit when you have TypeScript and a tsconfig.json, then vitest run or jest --ci. Test counts come from a JSON report when the script is a plain Vitest or Jest call, otherwise from the summary line. Watch, e2e, Playwright, Cypress, lint and format scripts are skipped.

In the evaluationCopy Anchor Link